What's changed: New GH-500 Chapter 1 (suites & architecture = three pillars Code Security/Secret Protection/Supply Chain, former names, public vs enterprise availability and licensing, Security Overview; secure SDLC & alert strategy = prevention-first vs gate-based, security campaigns, detect/manage/respond, roles [developer/security manager/admin], dismissal practice, delegated bypass and enforcement)
1.2Secure SDLC and Alert Strategy/Governance
Understand end-to-end secure SDLC with GitHub Security suites, prevention-first vs gate-based strategies, the role of security campaigns, detecting/managing/responding to alerts, and roles (developer/security/admin), delegated bypass, and enforcement.
GHAS shines when features are embedded across the entire SDLC to "shift left" (prevent early). Security applies from coding through PR, merge, and deploy, running a detect → prioritize → remediate cycle. GH-500 tests strategy choice (prevention-first vs gate), campaign-based large-scale remediation, and roles/governance.
1.2.1Prevention-first vs gate-based
Prevention-first keeps problems out in the first place—e.g., Push Protection stops secret commits at the source (Chapter 2). Gate-based places checks before PR merge or deploy to control passage—making Code Scanning or Dependency Review required checks that block merges when vulnerabilities exist. They aren’t exclusive; combine them for layered defense. Note the role difference: "prevent introduction (prevention)" vs "don’t let it pass (gate)."
1.2.2Security campaigns
A security campaign bundles existing alerts across many repositories for planned remediation. A security team selects a target ("fix this class of vulnerability by a deadline"), assigns remediation to each repo’s owners, and tracks progress. It’s effective for reducing large-scale risk/technical debt that per-alert handling can’t keep up with, combined with PR-based remediation and automation.
1.2.3Alert management, roles, and delegated bypass
Alerts carry role-based responsibilities—developers fix alerts in their code/PRs, security managers handle policy/prioritization/exceptions, and admins govern feature enablement and policies. Dismissing/ignoring alerts must be done carefully with recorded reasons (careless dismissal misses risk). Delegated bypass lets a block (e.g., Push Protection) be temporarily bypassed with approval, controlling who may approve via access management and enforcement.
Common: (1) Prevention-first (Push Protection at the source) vs gate-based (required checks blocking before merge/deploy)—and combining them. (2) Security campaigns = bundle existing alerts across many repos for planned large-scale remediation. (3) Roles = developer (fix) / security manager (policy/exceptions) / admin (enablement/policy). (4) Dismiss alerts carefully with recorded reasons. (5) Delegated bypass = approval-gated temporary bypass (control who may approve).
Watch out: (1) Prevention (don’t introduce) and gate (don’t let pass) are different roles—use layers, not just one. (2) Careless alert dismissal misses risk (need recorded reasons and policy). (3) Delegated bypass isn’t "unlimited bypass"—it’s an approval-gated exception; control who may approve. (4) Security campaigns aren’t a replacement for per-alert fixes—they’re a mechanism for bundled large-scale remediation.
1.2.4Section summary
- Combine prevention-first (block at source) and gate-based (block before merge/deploy) for layers
- Use security campaigns to bundle existing alerts across repos for planned large-scale remediation
- Roles: developer (fix) / security manager (policy/exceptions) / admin (enablement/policy)
- Dismiss carefully with recorded reasons; delegated bypass is an approval-gated exception (control approvers)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Preventing secrets from "ever being committed" at the source belongs to which strategy?
Q2. Making Code Scanning or Dependency Review a required check before merge so vulnerabilities can’t pass is which strategy?
Q3. Which mechanism bundles existing alerts across many repos and drives planned remediation to a deadline?
Q4. Which is responsible practice for dismissing/ignoring security alerts?
Q5. Which lets a block (e.g., Push Protection) be temporarily bypassed with approval?
Q6. What best captures the aim of "shift left" by embedding GHAS across the SDLC?