{"id":52198,"date":"2020-03-18T14:37:28","date_gmt":"2020-03-18T21:37:28","guid":{"rendered":"https:\/\/github.blog\/?p=52198"},"modified":"2020-04-15T10:43:09","modified_gmt":"2020-04-15T17:43:09","slug":"cert-partners-with-github-security-lab-for-automated-remediation","status":"publish","type":"post","link":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/","title":{"rendered":"CERT partners with GitHub Security Lab for automated remediation"},"content":{"rendered":"

As security researchers, the GitHub Security Lab team constantly embarks on an emotional journey with each new vulnerability challenge. The excitement of starting new research, the disappointment that comes with hitting a plateau, the energy it takes to stay focused and on target…and hopefully, the sheer joy of achieving a tangible result after weeks or months of working on a problem that seemed unsolvable.<\/p>\n

Regardless of how proud you are of the results, do you ever get a nagging feeling that maybe you didn’t make enough of an impact? While single bug fixes are worthwhile in improving code, it\u2019s not sufficient enough to improve the state of security of the open source software (OSS) ecosystem as a whole. This holds true especially when you consider that software is always growing and changing\u2014and as vulnerabilities are fixed, new ones are introduced.<\/p>\n

Beyond single bug fixes<\/span><\/a><\/h2>\n

At GitHub, we host millions of OSS projects which puts us in a unique position to take a different approach with OSS security. We have the power and responsibility to make an impact beyond single bug fixes. This is why a big part of the GitHub Security Lab mission is to find ways to scale our vulnerability hunting efforts and empower others to do the same.<\/p>\n

Our goal is to turn single vulnerabilities into hundreds, if not thousands, of bug fixes at a time. Enabled by the GitHub engineering teams, we aim to establish workflows that are open to the community that tackle vulnerabilities at scale on the GitHub platform.<\/p>\n

Ultimately, we want to establish feedback loops with the developer and security communities, and act as security facilitators, all while working with the OSS community to secure the software we all depend upon.<\/p>\n

\n

We\u2019re taking a deep-dive in the remediation of a security vulnerability with CERT. Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same.<\/p>\n

Continue reading on the Security Lab blog<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.<\/p>\n","protected":false},"author":1776,"featured_media":48372,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gh_post_show_toc":"","_gh_post_is_no_robots":"","_gh_post_is_featured":"","_gh_post_is_excluded":"","_gh_post_is_unlisted":"","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"","_gh_post_sq_img_id":"","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"","_gh_post_recirc_hide":"","_gh_post_recirc_col_1":"","_gh_post_recirc_col_2":"","_gh_post_recirc_col_3":"","_gh_post_recirc_col_4":"","_featured_video":"","_gh_post_additional_query_params":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[72,3310],"tags":[],"coauthors":[],"class_list":["post-52198","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-engineering","category-platform-security"],"yoast_head":"\nCERT partners with GitHub Security Lab for automated remediation - The GitHub Blog<\/title>\n<meta name=\"description\" content=\"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CERT partners with GitHub Security Lab for automated remediation\" \/>\n<meta property=\"og:description\" content=\"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-03-18T21:37:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-04-15T17:43:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630\" \/>\n\t<meta property=\"og:image:width\" content=\"1201\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Nico Waisman\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"CERT partners with GitHub Security Lab for automated remediation\" \/>\n<meta name=\"twitter:description\" content=\"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nico Waisman\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/\"},\"author\":{\"name\":\"Nico Waisman\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/193e365135a95ddadec7d7fb3b742f7a\"},\"headline\":\"CERT partners with GitHub Security Lab for automated remediation\",\"datePublished\":\"2020-03-18T21:37:28+00:00\",\"dateModified\":\"2020-04-15T17:43:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/\"},\"wordCount\":341,\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/engineering-social.png?fit=1201%2C630\",\"articleSection\":[\"Engineering\",\"Platform security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/\",\"name\":\"CERT partners with GitHub Security Lab for automated remediation - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/engineering-social.png?fit=1201%2C630\",\"datePublished\":\"2020-03-18T21:37:28+00:00\",\"dateModified\":\"2020-04-15T17:43:09+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/193e365135a95ddadec7d7fb3b742f7a\"},\"description\":\"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/engineering-social.png?fit=1201%2C630\",\"contentUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/engineering-social.png?fit=1201%2C630\",\"width\":1201,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/cert-partners-with-github-security-lab-for-automated-remediation\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Engineering\",\"item\":\"https:\\\/\\\/github.blog\\\/engineering\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Platform security\",\"item\":\"https:\\\/\\\/github.blog\\\/engineering\\\/platform-security\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"CERT partners with GitHub Security Lab for automated remediation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/193e365135a95ddadec7d7fb3b742f7a\",\"name\":\"Nico Waisman\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g1ac0ce284915b05da9ff797c6d8c2b01\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g\",\"caption\":\"Nico Waisman\"},\"url\":\"https:\\\/\\\/github.blog\\\/author\\\/nicowaisman\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CERT partners with GitHub Security Lab for automated remediation - The GitHub Blog","description":"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/","og_locale":"en_US","og_type":"article","og_title":"CERT partners with GitHub Security Lab for automated remediation","og_description":"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.","og_url":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/","og_site_name":"The GitHub Blog","article_published_time":"2020-03-18T21:37:28+00:00","article_modified_time":"2020-04-15T17:43:09+00:00","og_image":[{"width":1201,"height":630,"url":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","type":"image\/png"}],"author":"Nico Waisman","twitter_card":"summary_large_image","twitter_title":"CERT partners with GitHub Security Lab for automated remediation","twitter_description":"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.","twitter_image":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","twitter_misc":{"Written by":"Nico Waisman","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#article","isPartOf":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/"},"author":{"name":"Nico Waisman","@id":"https:\/\/github.blog\/#\/schema\/person\/193e365135a95ddadec7d7fb3b742f7a"},"headline":"CERT partners with GitHub Security Lab for automated remediation","datePublished":"2020-03-18T21:37:28+00:00","dateModified":"2020-04-15T17:43:09+00:00","mainEntityOfPage":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/"},"wordCount":341,"image":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","articleSection":["Engineering","Platform security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/","url":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/","name":"CERT partners with GitHub Security Lab for automated remediation - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#primaryimage"},"image":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","datePublished":"2020-03-18T21:37:28+00:00","dateModified":"2020-04-15T17:43:09+00:00","author":{"@id":"https:\/\/github.blog\/#\/schema\/person\/193e365135a95ddadec7d7fb3b742f7a"},"description":"Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we\u2019ll take a deep-dive in the remediation of a security vulnerability with CERT.","breadcrumb":{"@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#primaryimage","url":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","contentUrl":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","width":1201,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/engineering\/platform-security\/cert-partners-with-github-security-lab-for-automated-remediation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Engineering","item":"https:\/\/github.blog\/engineering\/"},{"@type":"ListItem","position":3,"name":"Platform security","item":"https:\/\/github.blog\/engineering\/platform-security\/"},{"@type":"ListItem","position":4,"name":"CERT partners with GitHub Security Lab for automated remediation"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/github.blog\/#\/schema\/person\/193e365135a95ddadec7d7fb3b742f7a","name":"Nico Waisman","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g1ac0ce284915b05da9ff797c6d8c2b01","url":"https:\/\/secure.gravatar.com\/avatar\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9d540246aa8ee60cddb7c1930f4720cccfee7a8a46b35a0f3bd4b585ec34e1c4?s=96&d=mm&r=g","caption":"Nico Waisman"},"url":"https:\/\/github.blog\/author\/nicowaisman\/"}]}},"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/pamS32-dzU","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/github.blog\/wp-content\/uploads\/2019\/03\/engineering-social.png?fit=1201%2C630","_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/52198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/1776"}],"replies":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/comments?post=52198"}],"version-history":[{"count":9,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/52198\/revisions"}],"predecessor-version":[{"id":52282,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/52198\/revisions\/52282"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media\/48372"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=52198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/categories?post=52198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/tags?post=52198"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=52198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}