Interpreting security findings

About security findings

After you apply a security configuration to a repository, the enabled security features will likely raise security findings on that repository. These findings may show up as feature-specific alerts, or as automatically generated pull requests designed to keep your repositories secure. You can analyze the findings across the organization and make any necessary adjustments to your security configuration.

To best secure your organization, you should encourage contributors to review and resolve security alerts and pull requests. In addition, you can collaborate with contributors to fix historical security alerts, see 대규모 보안 경고 수정 모범 사례.

Finding repositories with security alerts using security overview

보안 개요에 표시되는 정보는 리포지토리와 조직에 대한 액세스 권한 및 Advanced Security 기능이 해당 리포지토리 및 조직에서 사용되는지 여부에 따라 달라집니다. 자세한 내용은 보안 개요을(를) 참조하세요.

1. GitHub에서 조직의 기본 페이지로 이동합니다.

2. 조직 이름에서 보안을 클릭합니다.

   

3. By default, the overview shows alerts for all native GitHub tools (filter: tool:github). To display alerts for a specific tool, replace tool:github in the filter text box. For example:

   • tool:dependabot to show only alerts for dependencies identified by Dependabot.
   • tool:secret-scanning to only show alerts for secrets identified by secret scanning.
   • tool:codeql to show only alerts for potential security vulnerabilities identified by CodeQL code scanning.

4. You can add further filters to show only the repositories you want to assess. The list of repositories and metrics displayed on the page automatically update to match your current selection. For more information on filtering, see Filtering alerts in security overview.

5. 필요에 따라 왼쪽의 사이드바를 사용하여 특정 보안 기능에 대한 경고를 더 자세히 살펴볼 수 있습니다. 각 페이지에서 해당 기능과 관련된 필터를 사용하여 검색을 구체화할 수 있습니다. 사용 가능한 한정자에 대한 자세한 내용은 Filtering alerts in security overview을(를) 참조하세요.

Interpreting secret scanning alerts

Secret scanning은(는) 리포지토리의 전체 Git 기록과 해당 리포지토리 내의 문제, 끌어오기 요청, 토론 및 Wikis을 스캔하여 실수로 커밋된 토큰이나 프라이빗 키와 같은 유출된 비밀을 찾아 내는 보안 도구입니다. There are two types of secret scanning alerts:

• 파트너에 대한 비밀 검사 경고, which are sent to the provider who issued the secret
• 사용자에 대한 비밀 검사 경고, which appear on GitHub and can be resolved

You can view secret scanning alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking Secret scanning in the "Metrics" or "Alerts" section.

• Metrics. To see detailed information on push protection events, see Viewing metrics for secret scanning push protection.
• Alerts. To see detailed information on Default and Generic alerts for exposed secrets in the organization.

For an introduction to secret scanning alerts, see 비밀 검사 경고 정보.

To learn how to evaluate secret scanning alerts, see 비밀 검사에서 경고 평가.

Interpreting code scanning alerts

Code scanning는 GitHub 리포지토리의 코드를 분석하여 보안 취약성 및 코딩 오류를 찾는 데 사용하는 기능입니다. 분석으로 식별되는 모든 문제는 리포지토리에 표시됩니다. These problems are raised as code scanning alerts, which contain detailed information on the vulnerability or error detected.

You can view the code scanning alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking:

• CodeQL pull request alerts. To see information on code scanning alerts found and remediated in pull requests.
• Code scanning. To see detailed information on alerts for potentially vulnerable code in the organization, see Viewing metrics for pull request alerts.

For an introduction to code scanning alerts, see 코드 검사 경고 정보.

To learn how to interpret and resolve code scanning alerts, see Assessing code scanning alerts for your repository and Resolving code scanning alerts.

Interpreting Dependabot alerts

Dependabot alerts inform you about vulnerabilities in the dependencies that you use in repositories in your organization. You can view Dependabot alerts for an organization by navigating to the main page of that organization, clicking the Security tab, then clicking Dependabot.

For an introduction to Dependabot alerts, see Dependabot 경고 정보.

To learn how to interpret and resolve Dependabot alerts, see Viewing and updating Dependabot alerts.

Next steps

If you are using the GitHub-recommended security configuration, and your findings indicate the security enablement settings are not meeting your needs, you should create a custom security configuration. To get started, see 사용자 지정 보안 구성 만들기.

If you are using a custom security configuration, and your findings indicate the security enablement settings are not meeting your needs, you can edit your existing configuration. For more information, see 사용자 지정 보안 구성 편집.

Lastly, you can also edit your organization-level security settings with global settings. To learn more, see 조직에 대한 글로벌 보안 설정 구성.