{"id":68491,"date":"2023-02-06T07:02:16","date_gmt":"2023-02-06T15:02:16","guid":{"rendered":"https:\/\/github.blog\/?p=68491"},"modified":"2024-07-23T09:01:33","modified_gmt":"2024-07-23T16:01:33","slug":"how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow","status":"publish","type":"post","link":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/","title":{"rendered":"How to mitigate OWASP vulnerabilities while staying in the flow"},"content":{"rendered":"<p>The pace and scale of security vulnerabilities is increasing. This is in spite of the fact that teams have been trying to keep their code secure for years. So, why are vulnerabilities still such a problem? When teams use security tools and strategies that don\u2019t optimize the developer experience, development is slowed down. This creates frustration, undermines customer usability, and hampers business success. Businesses that use such tools and strategies end up de-prioritizing security, and instead focus on shipping software quickly.<\/p>\n<p>Here at GitHub, we want to help you mitigate vulnerabilities while boosting developer productivity. Fortunately, the Open Web Application Security Project (OWASP) can help. OWASP provides a <a href=\"https:\/\/owasp.org\/www-project-top-ten\/#:~:text=The%20OWASP%20Top%2010%20is,step%20towards%20more%20secure%20coding\">Top 10 list<\/a> of vulnerabilities that gives developers and organizations the context they need to address security and compliance risks within their applications. Today, we\u2019ll examine several of OWASP\u2019s vulnerabilities and developer-optimized strategies for keeping your software safe while maintaining and even increasing developer productivity.<\/p>\n<figure class=\"gh-full-blockquote mx-0 pl-6 mt-6 mt-md-7 mb-7 mb-md-8\"><blockquote><p>Security at the expense of usability comes at the expense of Security.<\/p><\/blockquote><figcaption class=\"text-mono color-fg-muted f5-mktg mt-3\">- Avi Douglen, OWASP Board of Directors<\/figcaption><\/figure>\n<h2 id=\"1-the-ideal-application-security-environment\"><a class=\"heading-link\" href=\"#1-the-ideal-application-security-environment\">1. The ideal application security environment<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p>First of all, your development team needs an environment that fosters success. And the most important part of this is embedding security into the developer workflow. Typically, disparate, third-party tools are used to identify security risks. But these tools can be slow, noisy, and decrease productivity. However, when security is integrated into the developer flow, you can secure your code quickly and easily. As discussed in the <a href=\"https:\/\/resources.github.com\/appsec\/#ghasebook\">GitHub Advanced Security ebook<\/a>, other ideal environment components include:<\/p>\n<ul>\n<li>Visibility into your security posture across code, secrets, and supply chain.<\/li>\n<li>Communication channels that are lightweight and context\u2010 sensitive, allowing for easy collaboration.<\/li>\n<li>Scalability with your business needs.<\/li>\n<\/ul>\n<p>It may not be possible to implement each of those capabilities at once, depending on the maturity of your business. But as you mature and continuously improve, fostering this ideal environment will help you protect against vulnerabilities and ship secure software faster.<\/p>\n<h2 id=\"2-owasp-vulnerabilities-risk-mitigation-and-prevention\"><a class=\"heading-link\" href=\"#2-owasp-vulnerabilities-risk-mitigation-and-prevention\">2. OWASP vulnerabilities risk mitigation and prevention<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p>Now that the ideal state has been described, let\u2019s look at a few OWASP vulnerabilities and some techniques to mitigate them.<\/p>\n<h3 id=\"a02-cryptographic-failures\"><a class=\"heading-link\" href=\"#a02-cryptographic-failures\"><a href=\"https:\/\/owasp.org\/Top10\/A02_2021-Cryptographic_Failures\/\">A02-Cryptographic Failures<\/a><span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h3>\n<p>No developer intentionally exposes their software to security threats. However, sometimes API keys, clear text passwords, security tokens, and other sensitive data may remain in code, leading to cryptographic vulnerabilities.<\/p>\n<p>Ideally, secrets would never reach your enterprise, organization, or repository. But they often do and need to be mitigated. Fortunately, GitHub Advanced Security can help.<\/p>\n<p>By implementing <a href=\"https:\/\/docs.github.com\/en\/enterprise-cloud@latest\/code-security\/secret-scanning\/protecting-pushes-with-secret-scanning\">push protection<\/a>, GitHub\u2019s <a href=\"https:\/\/docs.github.com\/en\/code-security\/secret-scanning\/about-secret-scanning\">secret scanning<\/a> feature will not only scan your code for exposed secrets, but also check pushes for high-confidence secrets (those identified with a low false positive rate). It will list any secrets it detects so you can review and remove them. If a decision is made not to remove them, an audit trail will be created.<\/p>\n<h3 id=\"a03-injection\"><a class=\"heading-link\" href=\"#a03-injection\"><a href=\"https:\/\/owasp.org\/Top10\/A03_2021-Injection\/\">A03-Injection<\/a><span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h3>\n<p>Cross-site scripting, path injection, SQL injection, and NoSQL injection are several of the vulnerabilities that have plagued applications for years and continue to stay in the OWASP Top 10 list.<\/p>\n<p>One strategy to address these vulnerabilities is running consistent and effective security <a href=\"https:\/\/github.com\/features\/code-review\">code reviews<\/a>. Not only will your code become cleaner, free of technical debt, and code smells, it will also become more secure. Reviewing these vulnerabilities can become part of your existing GitHub pull request workflow.<\/p>\n<p><a href=\"https:\/\/github.blog\/2022-02-17-code-scanning-finds-vulnerabilities-using-machine-learning\/\">Code scanning<\/a> can also leverage the power of machine learning to find injection vulnerabilities and help communicate risks to developers and security professionals. <a href=\"https:\/\/codeql.github.com\/\">CodeQL<\/a> powers code scanning and  scans your data for security vulnerabilities.<\/p>\n<h3 id=\"a04-insecure-design\"><a class=\"heading-link\" href=\"#a04-insecure-design\"><a href=\"https:\/\/owasp.org\/Top10\/A04_2021-Insecure_Design\/\">A04-Insecure Design<\/a><span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h3>\n<p><a href=\"https:\/\/github.blog\/2020-09-02-how-we-threat-model\/\">Threat modeling<\/a> strategies can be implemented to encourage collaboration between developers, security professionals, and even risk management teams. This can help ensure that the architecture and design patterns are as secure as possible long before a single line of code has been written.<\/p>\n<h3 id=\"a06-vulnerable-and-outdated-components\"><a class=\"heading-link\" href=\"#a06-vulnerable-and-outdated-components\"><a href=\"https:\/\/owasp.org\/Top10\/A06_2021-Vulnerable_and_Outdated_Components\/\">A06-Vulnerable and Outdated Components<\/a><span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h3>\n<p>As you continue to adopt open source components at a rapid pace, it\u2019s more important than ever to understand the composition of your software and be able to update vulnerable components.<\/p>\n<p>One of the best strategies for managing the risk of vulnerable and outdated components is to alert developers as soon as a security threat is found and give them the ability to take action in their normal workflows and tooling.<\/p>\n<p>By leveraging <a href=\"https:\/\/github.blog\/2022-05-25-how-we-use-dependabot-to-secure-github\/\">Dependabot<\/a>, you will receive an alert when a repository uses a software dependency with a known vulnerability. <a href=\"https:\/\/docs.github.com\/en\/code-security\/dependabot\/working-with-dependabot\/managing-pull-requests-for-dependency-updates\">A pull request can even be triggered<\/a> by the security team, which is a simple and effective way for security and developers to communicate.<\/p>\n<p>The best part of these tools is they happen within GitHub. So, you don\u2019t need to worry about decreased productivity or excessive context switching.<\/p>\n<h2 id=\"developer-empowering-application-security\"><a class=\"heading-link\" href=\"#developer-empowering-application-security\">Developer-empowering application security<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p>By implementing these strategies, you can create a developer-embedded, collaborative, and scalable application security environment that provides risk mitigation across the supply chain. At the same time, you will ensure that developer productivity is not adversely affected.<\/p>\n<div class=\"post-content-cta\"><p>We will be at the OWASP 2023 Global AppSec Dublin event from February 15-16, Booth #DA2. <a href=\"https:\/\/resources.github.com\/owasp-dublin-2023\/?utm_source=github&#038;utm_medium=blog&#038;utm_campaign=2023q3-evt-emea-OWASPDublin2023_Security_blog\">Book some time with our experts here<\/a> to dive deeper into this topic and answer any questions about these strategies.<\/p>\n<p>Want to gain hands-on experience? Then check out <a href=\"https:\/\/skills.github.com\/\">GitHub Skills<\/a> for details on this, and other hands-on learning exercises!<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities<\/p>\n","protected":false},"author":2058,"featured_media":68492,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gh_post_show_toc":"no","_gh_post_is_no_robots":"no","_gh_post_is_featured":"no","_gh_post_is_excluded":"no","_gh_post_is_unlisted":"no","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"","_gh_post_sq_img_id":"","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"Click Here to Learn More","_gh_post_recirc_hide":"no","_gh_post_recirc_col_1":"gh-auto-select","_gh_post_recirc_col_2":"66717","_gh_post_recirc_col_3":"65308","_gh_post_recirc_col_4":"65316","_featured_video":"","_gh_post_additional_query_params":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[3318,3313],"tags":[2902,1709],"coauthors":[2890],"class_list":["post-68491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devsecops","category-enterprise-software","tag-devsecops","tag-supply-chain-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.6 (Yoast SEO v28.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>How to mitigate OWASP vulnerabilities while staying in the flow - The GitHub Blog<\/title>\n<meta name=\"description\" content=\"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to mitigate OWASP vulnerabilities while staying in the flow\" \/>\n<meta property=\"og:description\" content=\"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-06T15:02:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-07-23T16:01:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"656\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Mark Paulsen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark Paulsen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/\"},\"author\":{\"name\":\"Mark Paulsen\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/689d6a243630dd0a4eb27299d4474c89\"},\"headline\":\"How to mitigate OWASP vulnerabilities while staying in the flow\",\"datePublished\":\"2023-02-06T15:02:16+00:00\",\"dateModified\":\"2024-07-23T16:01:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/\"},\"wordCount\":885,\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/owasp.png?fit=1200%2C656\",\"keywords\":[\"DevSecOps\",\"supply chain security\"],\"articleSection\":[\"DevSecOps\",\"Enterprise software\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/\",\"name\":\"How to mitigate OWASP vulnerabilities while staying in the flow - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/owasp.png?fit=1200%2C656\",\"datePublished\":\"2023-02-06T15:02:16+00:00\",\"dateModified\":\"2024-07-23T16:01:33+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/689d6a243630dd0a4eb27299d4474c89\"},\"description\":\"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#primaryimage\",\"url\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/owasp.png?fit=1200%2C656\",\"contentUrl\":\"https:\\\/\\\/github.blog\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/owasp.png?fit=1200%2C656\",\"width\":1200,\"height\":656},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Enterprise software\",\"item\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"DevSecOps\",\"item\":\"https:\\\/\\\/github.blog\\\/enterprise-software\\\/devsecops\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"How to mitigate OWASP vulnerabilities while staying in the flow\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/github.blog\\\/#\\\/schema\\\/person\\\/689d6a243630dd0a4eb27299d4474c89\",\"name\":\"Mark Paulsen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g067231c43678052cf48d1fb9d8278a21\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g\",\"caption\":\"Mark Paulsen\"},\"url\":\"https:\\\/\\\/github.blog\\\/author\\\/mjpaulsen\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to mitigate OWASP vulnerabilities while staying in the flow - The GitHub Blog","description":"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/","og_locale":"en_US","og_type":"article","og_title":"How to mitigate OWASP vulnerabilities while staying in the flow","og_description":"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities","og_url":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/","og_site_name":"The GitHub Blog","article_published_time":"2023-02-06T15:02:16+00:00","article_modified_time":"2024-07-23T16:01:33+00:00","og_image":[{"width":1200,"height":656,"url":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png","type":"image\/png"}],"author":"Mark Paulsen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Mark Paulsen","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#article","isPartOf":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/"},"author":{"name":"Mark Paulsen","@id":"https:\/\/github.blog\/#\/schema\/person\/689d6a243630dd0a4eb27299d4474c89"},"headline":"How to mitigate OWASP vulnerabilities while staying in the flow","datePublished":"2023-02-06T15:02:16+00:00","dateModified":"2024-07-23T16:01:33+00:00","mainEntityOfPage":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/"},"wordCount":885,"image":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png?fit=1200%2C656","keywords":["DevSecOps","supply chain security"],"articleSection":["DevSecOps","Enterprise software"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/","url":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/","name":"How to mitigate OWASP vulnerabilities while staying in the flow - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#primaryimage"},"image":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#primaryimage"},"thumbnailUrl":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png?fit=1200%2C656","datePublished":"2023-02-06T15:02:16+00:00","dateModified":"2024-07-23T16:01:33+00:00","author":{"@id":"https:\/\/github.blog\/#\/schema\/person\/689d6a243630dd0a4eb27299d4474c89"},"description":"Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities","breadcrumb":{"@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#primaryimage","url":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png?fit=1200%2C656","contentUrl":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png?fit=1200%2C656","width":1200,"height":656},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/enterprise-software\/devsecops\/how-to-mitigate-owasp-vulnerabilities-while-staying-in-the-flow\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Enterprise software","item":"https:\/\/github.blog\/enterprise-software\/"},{"@type":"ListItem","position":3,"name":"DevSecOps","item":"https:\/\/github.blog\/enterprise-software\/devsecops\/"},{"@type":"ListItem","position":4,"name":"How to mitigate OWASP vulnerabilities while staying in the flow"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/github.blog\/#\/schema\/person\/689d6a243630dd0a4eb27299d4474c89","name":"Mark Paulsen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g067231c43678052cf48d1fb9d8278a21","url":"https:\/\/secure.gravatar.com\/avatar\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a634d5b50426396b9772fbed7b19bdd7f8473db27127dac4f9686a7be04c46d5?s=96&d=mm&r=g","caption":"Mark Paulsen"},"url":"https:\/\/github.blog\/author\/mjpaulsen\/"}]}},"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/pamS32-hOH","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/github.blog\/wp-content\/uploads\/2022\/11\/owasp.png?fit=1200%2C656","_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/68491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/2058"}],"replies":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/comments?post=68491"}],"version-history":[{"count":5,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/68491\/revisions"}],"predecessor-version":[{"id":69724,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/posts\/68491\/revisions\/69724"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media\/68492"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=68491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/categories?post=68491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/tags?post=68491"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=68491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}