Code security guides
Learn about the different ways that GitHub can help you improve your code's security.
- 1Overview
关于安全漏洞的协调披露
漏洞披露是安全报告者与仓库维护者之间的协调工作。 - 2Overview
关于 GitHub 公告数据库
GitHub Advisory Database 包含已知安全漏洞和恶意软件的列表，分为两类：经 GitHub 审核的公告和未经审核的公告。 - 3Overview
关于全局安全公告
全局安全公告位于 GitHub Advisory Database，它是影响开源环境的 CVE 和 GitHub 发起的公告集合。 你可以为改进全局安全公告做出贡献。 - 4Overview
关于存储库安全公告
可以使用存储库安全公告来私下讨论、修复和发布有关存储库中安全漏洞的信息。 - 5How-to guide
Best practices for writing repository security advisories
When you create or edit security advisories, the information you provide is easier for other users to understand when you specify the ecosystem, package name, and affected versions using the standard formats. - 6How-to guide
私下报告安全漏洞
某些公共存储库配置安全公告，以便任何人都可以直接并私下向维护人员报告安全漏洞。 - 7How-to guide
管理私下报告的安全漏洞
存储库维护人员可以管理由存储库安全研究人员向其私下报告的安全漏洞，这些存储库已启用了非公开漏洞报告。 - 8How-to guide
Configuring private vulnerability reporting for a repository
Owners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting. - 9How-to guide
Configuring private vulnerability reporting for an organization
Organization owners and security managers can allow security researchers to report vulnerabilities securely in repositories within the organization by enabling private vulnerability reporting for all its public repositories. - 10How-to guide
创建存储库安全公告
您可以创建安全通告草稿，以私下讨论和修复开源项目中的安全漏洞。 - 11How-to guide
Adding a collaborator to a repository security advisory
You can add other users or teams to collaborate on a security advisory with you. - 12How-to guide
在临时专用分支中协作以解决存储库安全漏洞
您可以创建临时私有复刻，以私下协作修复仓库中的安全漏洞。 - 13How-to guide
Publishing a repository security advisory
You can publish a security advisory to alert your community about a security vulnerability in your project. - 14How-to guide
编辑存储库安全通告
如果需要更新详细信息或更正错误，可以编辑存储库安全公告的元数据和说明。 - 15How-to guide
撤销存储库安全通告
你可以撤销已发布的存储库安全公告。 - 16How-to guide
删除存储库安全公告中的协作者
协作者从存储库安全公告中删除后，将失去对安全公告的讨论和元数据的读取和写入权限。
Code security learning paths
Learning paths are a collection of guides that help you master a particular subject.
扫描机密
设置机密扫描以防意外检入令牌、密码和其他机密到你的存存储库。
与代码扫描集成
使用 SARIF 将分析结果从第三方系统上传到 GitHub。
All Code security guides
71 guides found
Adding a security policy to your repository
How-to guideYou can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.
- Security policies
- Vulnerabilities
- Repositories
- Health
GitHub 安全功能
OverviewGitHub 安全功能概述。
- Repositories
- Dependencies
- Vulnerabilities
- Advanced Security
保护你的组织
How-to guide您可以使用许多 GitHub 功能来帮助保护组织的安全。
- Organizations
- Dependencies
- Vulnerabilities
- Advanced Security
保护您的仓库
How-to guide您可以使用许多 GitHub 功能来帮助保护仓库的安全。
- Repositories
- Dependencies
- Vulnerabilities
- Advanced Security
About secret scanning
OverviewGitHub scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.
- Secret scanning
- Advanced Security
为存储库配置机密扫描
How-to guide可以配置 GitHub 如何扫描存储库中遭到泄露的机密并生成警报。
- Secret scanning
- Advanced Security
- Repositories
为机密扫描定义自定义模式
How-to guide你可以扩展 secret scanning 以检测默认模式之外的机密。
- Advanced Security
- Secret scanning
管理来自机密扫描的警报
How-to guide您可以查看并关闭已检入仓库的密码的警报。
- Secret scanning
- Advanced Security
- Alerts
- Repositories
使用机密扫描保护推送
How-to guide可以使用 secret scanning 通过启用推送保护，防止将支持的机密推送到 组织 或存储库中。
- Secret scanning
- Advanced Security
- Alerts
- Repositories