{"id":75264,"date":"2023-11-08T09:09:36","date_gmt":"2023-11-08T17:09:36","guid":{"rendered":"https:\/\/github.blog\/?p=75264"},"modified":"2024-03-25T14:55:17","modified_gmt":"2024-03-25T21:55:17","slug":"ai-powered-appsec","status":"publish","type":"post","link":"https:\/\/github.blog\/news-insights\/product-news\/ai-powered-appsec\/","title":{"rendered":"Introducing AI-powered application security testing with GitHub Advanced Security"},"content":{"rendered":"

At GitHub, we\u2019re focused on reducing workflow friction. Nowhere is this more important than when it comes to security. Developers need the ability to proactively secure their code right where it\u2019s created\u2014instead of testing for and remediating vulnerabilities after the fact. Embedded security is critical to delivering secure applications.<\/p>\n

Over the past year, GitHub Advanced Security released 70+ features to improve your application security testing and software supply chain capabilities. Dependabot now can group multiple version updates<\/a> in a single pull request, code scanning can perform variant analysis on up to 1,000 repositories<\/a> with a single query, and secret scanning now has validity checks<\/a>, in addition to being free for all public repositories<\/a>.<\/p>\n

And with AI, we have the potential to revolutionize how developers build secure applications<\/a> from the get-go, and radically transform the traditional definition of \u201cshift left.\u201d Today, we\u2019re excited to announce previews for three AI-powered features within GitHub Advanced Security, along with robust improvements for our security overview capability.<\/p>\n

Fix issues faster with code scanning autofix<\/span><\/a><\/h2>\n

\"Gif<\/p>\n

Code scanning, powered by our static analysis engine CodeQL, now includes an autofix capability designed to help developers achieve faster fix times, leading to increased productivity, less technical security debt, and more secure code.<\/p>\n

With this new feature, you\u2019ll receive AI-generated fixes for CodeQL JavaScript and TypeScript alerts right in your pull requests. These are not just any fixes, but precise, actionable suggestions that will allow you to quickly understand what the vulnerability is and how to remediate it. You can instantly commit these fixes to your code, helping you resolve issues faster and preventing new vulnerabilities from creeping into your codebases. So, how does this work?<\/p>\n

After the CodeQL analysis, GitHub seamlessly queries an advanced LLM for fixes to any new alerts. These AI-generated remediation suggestions are posted as code suggestions on the ‘Conversation’ and ‘Files Changed’ tabs of the pull request. You can then view and accept these recommended changes, or even edit the suggested fixes before merging them into your codebase.<\/p>\n

The beauty of this feature is that it provides a frictionless remediation experience, as users can rapidly fix vulnerabilities while they code, resulting in an even faster time to remediation\u2014with all the same accuracy that code scanning users have come to expect.<\/p>\n

Detect leaked passwords with secret scanning<\/span><\/a><\/h2>\n

\"Screenshot<\/p>\n

Passwords are a challenging category within secret detection. They are commonly leaked, and as a result, are a popular target of malicious attackers seeking to gain unauthorized access. Unfortunately, passwords are difficult to detect by secret detection solutions because they don\u2019t follow a specific pattern. The latest generation of LLMs presents an opportunity to find these passwords with lower false positives than traditional methods.<\/p>\n

Currently in limited public beta, secret scanning now leverages the power of AI to detect generic or unstructured secrets in your code.<\/p>\n

Findings will be displayed in a separate tab called \u201cOther,\u201d alongside additional low confidence patterns. Here, security managers and repository owners can view alerts about a possibly active leaked password\u2014 while still focusing on remediating the highest-confidence findings in the existing UX. If they determine that the alert is legitimate, they can work with the developer to resolve the issue.<\/p>\n

Save time with regular expression generator for custom patterns<\/span><\/a><\/h2>\n

\"Gif<\/p>\n

While GitHub\u2019s secret scanning partner program is robust, boasting 180 partners and over 225 supported patterns, users may still need to create additional custom patterns to detect secret types unique to their organization. Like learning a mini-coding language, writing regular expressions can be difficult because of the many parameters and nuances involved.<\/p>\n

To make it easier and faster for you to create and update custom patterns, GitHub now includes an AI-powered experience for authoring custom patterns. Through this form-based experience, all you have to do is answer a few simple questions to auto-generate custom patterns in the form of regular expressions. This new feature enables you to execute dry runs in real time to ensure proper scanning before saving the newly created pattern.<\/p>\n

These updates are not just incredible time savers, but they will ultimately help you get the coverage you need to make sure your secrets are secure.<\/p>\n

View more crucial data with the new security overview dashboard<\/span><\/a><\/h2>\n

\"Screenshot<\/p>\n

While GitHub Advanced Security is tailored for developers, every successful security program is a collaboration between developers and security teams. Now, with security overview\u2019s new dashboard, security managers and administrators will have access to a new dashboard that brings historical trend analysis to your security alerts on GitHub.<\/p>\n

With this dashboard, you\u2019ll be able to understand your organization\u2019s holistic security posture through the lens of risks, remediations, and prevention:<\/p>\n