---
layout: post
title:  "Keeping Safe: Github Vulnerabilities"
date:   2021-05-20 16:43:34 -0500
categories: security github
---
I know you've heard this before, but I'm going to keep reinforcing it and drilling it home. I run stats [every Friday](https://docs.google.com/spreadsheets/d/1o9RKz3lisq_yjgxM7F1F6Bno6mg2l5wi-4euQK6OXq4/edit?usp=sharing), and I'll start posting the top ranking repos in Slack each week. I know a few people have started to help the appsec team take care of them, and really appreciate their work.

Github remediations are something everyone can and should contribute to - you know the repos you are working on better than the appsec team does, and can update them faster. When Github finds a new vulnerability in a package we use, we suddenly have a bunch of repos that need updates. Despite our efforts the number of repos with vulnerabilities was trending up lately due to new issues being found.

**How to Help?**

You'll need to enable the vulnerability scan on your own forks. On your fork, in Github, follow these steps to enable security scans.
Go into Settings, to the Security & Analysis tab
![Settings View](/assets/keeping-safe-1.png)

Click "Enable" on Dependabot Alerts (if it says "Disable", then it's already enabled and you're good to go). This will also enable the dependency graph.
![Enable Dialog](/assets/keeping-safe-2.png)
![Enabled](/assets/keeping-safe-3.png)

After that, you should see vulnerabilities appear under the Security tab if there are any. You will generally have a warning on the main repo page if there are any vulnerabilities.
![Vulnerabilities](/assets/keeping-safe-4.png)

**“So I see a vulnerability, what next?”**

Go to the Security tab, and pick Dependabot Alerts on the left side, and you'll be able to see which packages triggered it, and what files include the vulnerable package. Clicking on a specific vulnerability will give you more information about it.
![Alerts](/assets/keeping-safe-5.png)
![Vuln Details](/assets/keeping-safe-6.png)

Note - we have seen an issue where the settings didn't 'stick' when applied from Firefox. We have not had any issues setting them from Chrome.

If you're helping lead a team, make sure your team looks at vulnerabilities and makes some time to remediate them.

We focus on vulnerabilities in ows and graphql microservices for the most part, as these are potentially real vulnerabilities. Sometimes there is no way a certain vulnerability could be exploited, and then we can potentially close it without remediation, although often it's faster and easier to update a package than to figure out if it can be exploited or not. If you are certain it cannot be exploited, write the reasons up for me and I can dismiss the warning without fixing it.