WEBVTT

1
00:00:05.145 --> 00:00:07.335
<00:00:05.145>Thank <00:00:05.345>you <00:00:05.545>so <00:00:05.744>much <00:00:05.944>for <00:00:06.145>the <00:00:06.345>lovely <00:00:06.545>introduction.

2
00:00:07.595 --> 00:00:09.095
<00:00:07.595>As <00:00:07.865>mentioned, <00:00:08.135>my <00:00:08.405>name's <00:00:08.675>Kevin <00:00:08.945>Lewis.

3
00:00:09.235 --> 00:00:11.895
<00:00:09.235>I'm <00:00:09.468>a <00:00:09.701>senior <00:00:09.934>developer <00:00:10.168>advocate <00:00:10.401>at <00:00:10.635>GitHub,

4
00:00:11.945 --> 00:00:14.575
<00:00:11.945>which <00:00:12.120>means <00:00:12.295>I <00:00:12.470>have <00:00:12.645>the <00:00:12.820>privilege <00:00:12.995>of <00:00:13.170>helping <00:00:13.345>developers

5
00:00:14.575 --> 00:00:17.055
<00:00:14.575>and <00:00:14.854>organizations <00:00:15.135>get, <00:00:15.415>get <00:00:15.694>the <00:00:15.975>most

6
00:00:17.075 --> 00:00:20.495
<00:00:17.075>and <00:00:17.275>understand <00:00:17.474>more <00:00:17.675>about <00:00:17.875>the <00:00:18.075>entire <00:00:18.275>GitHub <00:00:18.474>platform.

7
00:00:20.995 --> 00:00:24.055
<00:00:20.995>And <00:00:21.122>I'm <00:00:21.249>kind <00:00:21.376>of <00:00:21.504>hoping <00:00:21.631>that <00:00:21.758>by <00:00:21.885>being <00:00:22.013>at, <00:00:22.140>we <00:00:22.267>are <00:00:22.395>developers,

8
00:00:24.115 --> 00:00:25.575
<00:00:24.115>you <00:00:24.377>have <00:00:24.640>heard <00:00:24.903>of <00:00:25.166>GitHub <00:00:25.429>before,

9
00:00:25.875 --> 00:00:29.295
<00:00:25.875>but <00:00:26.015>if <00:00:26.155>not, <00:00:26.295>GitHub <00:00:26.435>is <00:00:26.575>the <00:00:26.715>home <00:00:26.855>for <00:00:26.995>the <00:00:27.134>world's <00:00:27.275>developers.

10
00:00:29.425 --> 00:00:32.615
<00:00:29.425>There <00:00:29.625>are <00:00:29.825>over <00:00:30.025>150 <00:00:30.225>million <00:00:30.425>developers <00:00:30.625>using <00:00:30.825>GitHub

11
00:00:32.715 --> 00:00:35.615
<00:00:32.715>and <00:00:32.948>over <00:00:33.181>1 <00:00:33.415>billion <00:00:33.648>repositories <00:00:33.881>having <00:00:34.115>been

12
00:00:35.615 --> 00:00:37.095
<00:00:35.615>created <00:00:36.059>on <00:00:36.503>the <00:00:36.947>platform.

13
00:00:37.355 --> 00:00:40.215
<00:00:37.355>If <00:00:37.529>you <00:00:37.705>write <00:00:37.879>code <00:00:38.055>or <00:00:38.230>have <00:00:38.404>ever <00:00:38.580>written <00:00:38.754>code

14
00:00:40.355 --> 00:00:43.615
<00:00:40.355>or <00:00:40.510>perhaps <00:00:40.666>knows <00:00:40.821>somebody <00:00:40.977>who <00:00:41.132>has <00:00:41.288>written <00:00:41.443>code, <00:00:41.599>chances <00:00:41.754>are,

15
00:00:43.955 --> 00:00:44.975
<00:00:43.955>you <00:00:44.184>know <00:00:44.414>what <00:00:44.643>GitHub <00:00:44.873>is.

16
00:00:44.975 --> 00:00:47.495
<00:00:44.975>But <00:00:45.102>there <00:00:45.229>you <00:00:45.356>go. <00:00:45.484>I <00:00:45.611>have <00:00:45.738>done <00:00:45.865>my <00:00:45.993>done <00:00:46.120>my <00:00:46.247>piece <00:00:46.375>there

17
00:00:47.515 --> 00:00:48.855
<00:00:47.515>for <00:00:47.816>those <00:00:48.118>who <00:00:48.419>may <00:00:48.721>not,

18
00:00:49.435 --> 00:00:52.575
<00:00:49.435>but <00:00:49.562>writing <00:00:49.689>new <00:00:49.816>code <00:00:49.944>is <00:00:50.071>just <00:00:50.198>one <00:00:50.325>small <00:00:50.453>part <00:00:50.580>of <00:00:50.707>the <00:00:50.835>job

19
00:00:52.575 --> 00:00:53.615
<00:00:52.575>that <00:00:53.043>developers <00:00:53.511>do.

20
00:00:53.915 --> 00:00:57.135
<00:00:53.915>The <00:00:54.089>rest <00:00:54.265>of <00:00:54.440>our <00:00:54.615>time <00:00:54.790>is <00:00:54.964>spent <00:00:55.140>planning, <00:00:55.315>maintaining

21
00:00:58.035 --> 00:01:02.175
<00:00:58.035>my <00:00:58.315>grading, <00:00:58.595>running, <00:00:58.875>retros, <00:00:59.154>debugging, <00:00:59.434>refactoring,

22
00:01:02.175 --> 00:01:03.295
<00:01:02.175>if <00:01:02.376>I <00:01:02.578>haven't <00:01:02.779>said <00:01:02.981>that <00:01:03.183>already.

23
00:01:03.475 --> 00:01:07.015
<00:01:03.475>The <00:01:03.591>whole <00:01:03.708>point <00:01:03.825>is <00:01:03.941>there <00:01:04.058>is <00:01:04.175>so <00:01:04.291>much <00:01:04.408>that <00:01:04.525>we <00:01:04.641>have <00:01:04.758>to <00:01:04.875>do.

24
00:01:07.635 --> 00:01:10.575
<00:01:07.635>And <00:01:07.810>increasingly, <00:01:07.985>we <00:01:08.160>are <00:01:08.335>also <00:01:08.510>needing <00:01:08.685>to <00:01:08.860>think <00:01:09.035>about

25
00:01:11.295 --> 00:01:12.775
<00:01:11.295>security <00:01:11.739>as <00:01:12.183>a <00:01:12.627>responsibility

26
00:01:13.005 --> 00:01:15.495
<00:01:13.005>that <00:01:13.179>we <00:01:13.354>all <00:01:13.530>have, <00:01:13.705>uh, <00:01:13.880>that <00:01:14.054>we <00:01:14.229>all <00:01:14.405>have.

27
00:01:15.835 --> 00:01:18.375
<00:01:15.835>And <00:01:16.068>why <00:01:16.301>is <00:01:16.535>that? <00:01:16.768>In <00:01:17.001>most <00:01:17.235>organizations,

28
00:01:18.375 --> 00:01:21.615
<00:01:18.375>there <00:01:18.550>is <00:01:18.725>only <00:01:18.900>one <00:01:19.075>developer <00:01:19.250>for, <00:01:19.425>uh, <00:01:19.600>for <00:01:19.775>every,

29
00:01:21.705 --> 00:01:24.495
<00:01:21.705>there <00:01:21.938>was <00:01:22.171>only <00:01:22.405>one <00:01:22.638>application <00:01:22.871>security <00:01:23.105>specialist

30
00:01:24.815 --> 00:01:29.455
<00:01:24.815>specifically <00:01:24.990>for <00:01:25.164>every <00:01:25.340>100 <00:01:25.515>developers, <00:01:25.690>which <00:01:25.865>was, <00:01:26.039>I <00:01:26.215>mean,

31
00:01:29.795 --> 00:01:31.655
<00:01:29.795>in <00:01:29.995>some <00:01:30.195>ways <00:01:30.395>I'm <00:01:30.595>unsurprised <00:01:30.795>in <00:01:30.995>other <00:01:31.195>ways.

32
00:01:31.735 --> 00:01:32.895
<00:01:31.735>I <00:01:31.996>think <00:01:32.257>it's <00:01:32.518>quite <00:01:32.779>stark.

33
00:01:32.985 --> 00:01:34.695
<00:01:32.985>Those <00:01:33.185>of <00:01:33.385>you <00:01:33.585>who <00:01:33.785>are <00:01:33.985>here <00:01:34.185>sat <00:01:34.385>down,

34
00:01:35.075 --> 00:01:36.375
<00:01:35.075>put <00:01:35.270>your <00:01:35.465>hand <00:01:35.660>up <00:01:35.855>if <00:01:36.050>you <00:01:36.245>are

35
00:01:36.935 --> 00:01:38.855
<00:01:36.935>specifically <00:01:37.401>a <00:01:37.868>security <00:01:38.335>specialist.

36
00:01:40.765 --> 00:01:43.655
<00:01:40.765>Yeah. <00:01:41.231>Okay. <00:01:41.698>Three, <00:01:42.165>three.

37
00:01:43.665 --> 00:01:45.135
<00:01:43.664>There <00:01:43.812>was <00:01:43.958>a <00:01:44.106>couple <00:01:44.252>here <00:01:44.399>at <00:01:44.547>the <00:01:44.693>front <00:01:44.841>as <00:01:44.987>well.

38
00:01:45.195 --> 00:01:46.855
<00:01:45.195>One <00:01:45.350>at <00:01:45.506>the <00:01:45.661>back, <00:01:45.817>like, <00:01:45.972>I <00:01:46.128>think <00:01:46.283>you <00:01:46.439>are <00:01:46.595>kind

39
00:01:46.855 --> 00:01:47.895
<00:01:46.854>of <00:01:47.089>making <00:01:47.323>my <00:01:47.557>point <00:01:47.791>here.

40
00:01:48.395 --> 00:01:51.095
<00:01:48.395>Um, <00:01:48.628>and <00:01:48.861>that's <00:01:49.095>because <00:01:49.328>in <00:01:49.561>most <00:01:49.795>organizations,

41
00:01:51.555 --> 00:01:54.255
<00:01:51.555>um, <00:01:52.021>or <00:01:52.488>rather, <00:01:52.955>sorry.

42
00:01:54.475 --> 00:01:56.735
<00:01:54.475>Um, <00:01:54.675>yeah, <00:01:54.875>th <00:01:55.074>this <00:01:55.274>is <00:01:55.475>really <00:01:55.675>challenging, <00:01:55.875>right?

43
00:01:56.765 --> 00:01:59.375
<00:01:56.765>There's <00:01:57.045>so <00:01:57.325>few <00:01:57.605>application <00:01:57.885>security <00:01:58.165>specialists

44
00:01:59.715 --> 00:02:01.735
<00:01:59.715>for <00:01:59.948>every <00:02:00.181>developer <00:02:00.415>that, <00:02:00.648>that <00:02:00.881>we <00:02:01.115>have.

45
00:02:01.755 --> 00:02:03.575
<00:02:01.755>So <00:02:01.988>it <00:02:02.221>becomes <00:02:02.455>all <00:02:02.688>of <00:02:02.921>our <00:02:03.155>responsibilities

46
00:02:03.715 --> 00:02:05.335
<00:02:03.715>to <00:02:04.065>really <00:02:04.415>care <00:02:04.765>about <00:02:05.115>this.

47
00:02:05.885 --> 00:02:08.335
<00:02:05.885>This <00:02:06.060>matters <00:02:06.235>because <00:02:06.410>we <00:02:06.585>are <00:02:06.760>producing <00:02:06.935>more <00:02:07.110>code <00:02:07.285>than

48
00:02:08.335 --> 00:02:09.455
<00:02:08.335>we <00:02:08.587>have <00:02:08.839>ever <00:02:09.091>produced <00:02:09.343>before.

49
00:02:09.715 --> 00:02:12.495
<00:02:09.715>And <00:02:09.870>this <00:02:10.026>is <00:02:10.181>made <00:02:10.337>even <00:02:10.492>more <00:02:10.648>prevalent <00:02:10.803>with <00:02:10.959>the <00:02:11.115>introduction

50
00:02:12.495 --> 00:02:15.495
<00:02:12.495>of <00:02:12.695>AI <00:02:12.895>tools, <00:02:13.095>making <00:02:13.295>developers <00:02:13.495>more <00:02:13.695>efficient, <00:02:13.895>producing

51
00:02:15.755 --> 00:02:18.335
<00:02:15.755>and <00:02:16.035>pushing <00:02:16.315>more <00:02:16.595>codes <00:02:16.875>than <00:02:17.155>ever.

52
00:02:18.595 --> 00:02:21.415
<00:02:18.595>And <00:02:18.734>with <00:02:18.875>that, <00:02:19.015>we <00:02:19.155>have <00:02:19.295>to <00:02:19.435>also <00:02:19.575>accept <00:02:19.715>that, <00:02:19.855>you <00:02:19.995>know,

53
00:02:21.435 --> 00:02:23.935
<00:02:21.435>for <00:02:21.590>all <00:02:21.746>of <00:02:21.901>that <00:02:22.057>amazing <00:02:22.212>productivity <00:02:22.368>gain <00:02:22.523>that <00:02:22.679>we <00:02:22.835>get,

54
00:02:24.105 --> 00:02:26.015
<00:02:24.105>we're <00:02:24.385>also <00:02:24.665>increasing <00:02:24.945>the <00:02:25.225>attack <00:02:25.505>surface

55
00:02:26.235 --> 00:02:29.735
<00:02:26.235>for <00:02:26.410>malicious <00:02:26.585>actors, <00:02:26.760>especially <00:02:26.935>when <00:02:27.110>not <00:02:27.285>always <00:02:27.460>are <00:02:27.635>we

56
00:02:30.235 --> 00:02:32.615
<00:02:30.235>really <00:02:30.390>doing <00:02:30.546>our <00:02:30.701>due <00:02:30.857>diligence <00:02:31.012>on <00:02:31.168>all <00:02:31.323>of <00:02:31.479>the <00:02:31.635>code

57
00:02:32.615 --> 00:02:35.215
<00:02:32.615>that <00:02:32.815>is <00:02:33.015>generated, <00:02:33.215>even <00:02:33.415>though <00:02:33.615>we <00:02:33.815>really <00:02:34.015>should.

58
00:02:35.795 --> 00:02:37.615
<00:02:35.795>Uh, <00:02:36.145>breaches <00:02:36.495>are <00:02:36.845>really <00:02:37.195>costly.

59
00:02:37.675 --> 00:02:40.455
<00:02:37.675>And <00:02:37.955>applications <00:02:38.235>as <00:02:38.515>a, <00:02:38.795>as <00:02:39.075>a,

60
00:02:40.555 --> 00:02:43.215
<00:02:40.555>as <00:02:40.730>an <00:02:40.905>attack <00:02:41.080>vector <00:02:41.255>remain <00:02:41.430>the <00:02:41.605>number <00:02:41.780>one <00:02:41.955>kind

61
00:02:43.215 --> 00:02:45.415
<00:02:43.215>of <00:02:43.495>entry <00:02:43.775>point <00:02:44.055>for <00:02:44.335>vulnerabilities, <00:02:44.615>uh,

62
00:02:45.435 --> 00:02:47.695
<00:02:45.435>for <00:02:45.668>exploitations <00:02:45.901>year <00:02:46.135>after <00:02:46.368>year <00:02:46.601>after <00:02:46.835>year.

63
00:02:48.075 --> 00:02:49.895
<00:02:48.075>And <00:02:48.308>changing <00:02:48.541>this <00:02:48.774>is <00:02:49.008>really <00:02:49.241>difficult, <00:02:49.475>right?

64
00:02:49.965 --> 00:02:53.695
<00:02:49.965>Most <00:02:50.165>organizations <00:02:50.365>are <00:02:50.565>up <00:02:50.765>against <00:02:50.965>an <00:02:51.165>already <00:02:51.365>existing

65
00:02:54.215 --> 00:02:58.055
<00:02:54.215>mountain <00:02:54.390>of <00:02:54.565>tech <00:02:54.740>debt <00:02:54.915>generally, <00:02:55.090>but <00:02:55.265>also <00:02:55.440>security <00:02:55.615>debt.

66
00:02:58.395 --> 00:03:02.885
<00:02:58.395>94% <00:02:58.535>of <00:02:58.675>applications <00:02:58.815>that <00:02:58.955>are <00:02:59.095>built <00:02:59.235>have <00:02:59.375>some <00:02:59.515>kind <00:02:59.655>of <00:02:59.795>flaw

67
00:03:03.065 --> 00:03:05.485
<00:03:03.065>or <00:03:03.415>vulnerability <00:03:03.765>held <00:03:04.115>within <00:03:04.465>them.

68
00:03:05.785 --> 00:03:09.165
<00:03:05.785>And <00:03:05.901>over <00:03:06.018>half, <00:03:06.135>over <00:03:06.251>half <00:03:06.368>of <00:03:06.484>those <00:03:06.601>are <00:03:06.718>more <00:03:06.835>than <00:03:06.951>a <00:03:07.068>year <00:03:07.185>old,

69
00:03:09.165 --> 00:03:12.965
<00:03:09.165>which <00:03:09.398>again, <00:03:09.631>rationally <00:03:09.864>I <00:03:10.098>understand <00:03:10.331>this, <00:03:10.565>right?

70
00:03:12.965 --> 00:03:15.245
<00:03:12.965>There <00:03:13.120>are <00:03:13.276>tasks <00:03:13.431>that <00:03:13.587>are <00:03:13.742>always <00:03:13.898>lower <00:03:14.053>down <00:03:14.209>in <00:03:14.365>the

71
00:03:15.275 --> 00:03:16.365
<00:03:15.275>task <00:03:15.602>list <00:03:15.929>than <00:03:16.256>others.

72
00:03:16.865 --> 00:03:18.965
<00:03:16.865>Uh, <00:03:17.065>and <00:03:17.265>some <00:03:17.465>will <00:03:17.665>always <00:03:17.865>get <00:03:18.065>pushed <00:03:18.265>off

73
00:03:18.965 --> 00:03:20.005
<00:03:18.965>in <00:03:19.199>favor <00:03:19.433>of <00:03:19.667>something <00:03:19.901>else.

74
00:03:20.435 --> 00:03:23.085
<00:03:20.435>More <00:03:20.575>than <00:03:20.715>half <00:03:20.855>of <00:03:20.995>these <00:03:21.135>are <00:03:21.275>over <00:03:21.415>a <00:03:21.555>year <00:03:21.695>old, <00:03:21.835>right?

75
00:03:23.105 --> 00:03:24.725
<00:03:23.105>We <00:03:23.280>know <00:03:23.454>they're <00:03:23.630>a <00:03:23.804>problem, <00:03:23.980>we're <00:03:24.155>just <00:03:24.329>not <00:03:24.505>getting

76
00:03:24.725 --> 00:03:25.765
<00:03:24.725>around <00:03:25.036>to <00:03:25.349>fixing <00:03:25.661>them.

77
00:03:25.995 --> 00:03:29.045
<00:03:25.995>Organizations <00:03:26.228>just <00:03:26.461>do <00:03:26.695>not <00:03:26.928>have <00:03:27.161>the <00:03:27.395>resource

78
00:03:29.185 --> 00:03:30.645
<00:03:29.185>or <00:03:29.623>the <00:03:30.061>in-house <00:03:30.499>expertise,

79
00:03:30.665 --> 00:03:34.045
<00:03:30.665>or <00:03:30.804>a <00:03:30.945>combination <00:03:31.084>of <00:03:31.225>the <00:03:31.364>two <00:03:31.505>to <00:03:31.644>fix <00:03:31.785>the <00:03:31.924>potentially <00:03:32.065>tens

80
00:03:34.045 --> 00:03:37.405
<00:03:34.045>of <00:03:34.278>thousands <00:03:34.511>of <00:03:34.745>security <00:03:34.978>vulnerabilities <00:03:35.211>across <00:03:35.445>all

81
00:03:37.405 --> 00:03:39.765
<00:03:37.405>of <00:03:37.605>the <00:03:37.805>code <00:03:38.005>bases <00:03:38.205>that <00:03:38.405>they <00:03:38.605>might <00:03:38.805>maintain.

82
00:03:40.105 --> 00:03:42.325
<00:03:40.105>And <00:03:40.244>this <00:03:40.385>is <00:03:40.524>a <00:03:40.665>problem <00:03:40.804>because <00:03:40.945>the <00:03:41.084>longer <00:03:41.225>you <00:03:41.364>leave <00:03:41.505>a

83
00:03:42.325 --> 00:03:46.125
<00:03:42.325>vulnerability, <00:03:42.500>uh, <00:03:42.674>the <00:03:42.850>more <00:03:43.024>costly <00:03:43.200>it <00:03:43.375>becomes <00:03:43.549>to <00:03:43.725>fix.

84
00:03:46.665 --> 00:03:48.045
<00:03:46.665>Of <00:03:46.913>course, <00:03:47.161>ideally, <00:03:47.410>the <00:03:47.658>best <00:03:47.907>time

85
00:03:48.045 --> 00:03:49.485
<00:03:48.045>to <00:03:48.477>catch <00:03:48.909>vulnerabilities <00:03:49.341>is

86
00:03:49.485 --> 00:03:52.885
<00:03:49.485>during <00:03:49.685>development <00:03:49.885>when <00:03:50.085>we <00:03:50.285>are <00:03:50.485>actually <00:03:50.685>writing <00:03:50.885>code,

87
00:03:53.145 --> 00:03:55.605
<00:03:53.145>but <00:03:53.495>certainly <00:03:53.845>before <00:03:54.195>production, <00:03:54.545>where

88
00:03:56.125 --> 00:03:59.405
<00:03:56.125>a <00:03:56.405>breach <00:03:56.685>can <00:03:56.965>be <00:03:57.245>incredibly <00:03:57.525>costly.

89
00:04:00.245 --> 00:04:04.485
<00:04:00.245>A <00:04:00.372>large <00:04:00.499>bank <00:04:00.626>had <00:04:00.754>a <00:04:00.881>data <00:04:01.008>breach <00:04:01.135>in <00:04:01.263>2019 <00:04:01.390>stemming <00:04:01.517>from <00:04:01.645>a

90
00:04:04.485 --> 00:04:07.045
<00:04:04.485>service <00:04:04.718>side <00:04:04.951>request, <00:04:05.185>forgery, <00:04:05.418>vulnerability, <00:04:05.651>the <00:04:05.885>kind

91
00:04:07.045 --> 00:04:09.885
<00:04:07.045>of <00:04:07.200>error <00:04:07.356>that <00:04:07.511>as <00:04:07.667>developers, <00:04:07.822>we <00:04:07.978>are <00:04:08.133>quite <00:04:08.289>attuned <00:04:08.445>to,

92
00:04:10.105 --> 00:04:12.245
<00:04:10.105>to <00:04:10.454>knowing <00:04:10.804>how <00:04:11.155>to <00:04:11.505>avoid.

93
00:04:12.305 --> 00:04:17.205
<00:04:12.305>And <00:04:12.480>yet, <00:04:12.655>uh, <00:04:12.830>that <00:04:13.005>allowed <00:04:13.180>the, <00:04:13.355>uh, <00:04:13.530>the <00:04:13.705>exploitation

94
00:04:17.425 --> 00:04:21.605
<00:04:17.425>and <00:04:17.580>collection <00:04:17.736>of <00:04:17.891>a <00:04:18.047>hundred <00:04:18.202>million <00:04:18.358>customers <00:04:18.513>worth <00:04:18.669>of <00:04:18.825>data.

95
00:04:22.225 --> 00:04:26.525
<00:04:22.225>Uh, <00:04:22.365>a <00:04:22.505>credit <00:04:22.645>checking <00:04:22.785>agency, <00:04:22.925>uh, <00:04:23.065>had <00:04:23.205>a <00:04:23.345>vulnerability <00:04:23.485>in <00:04:23.625>a,

96
00:04:26.985 --> 00:04:29.965
<00:04:26.985>uh, <00:04:27.160>like <00:04:27.335>a <00:04:27.510>known <00:04:27.685>vulnerability <00:04:27.860>in <00:04:28.035>a <00:04:28.210>web <00:04:28.385>framework

97
00:04:29.965 --> 00:04:32.005
<00:04:29.965>that <00:04:30.164>they <00:04:30.364>were <00:04:30.565>using <00:04:30.765>that <00:04:30.965>was <00:04:31.164>left <00:04:31.364>unpatched

98
00:04:32.155 --> 00:04:33.205
<00:04:32.155>that <00:04:32.627>got <00:04:33.099>exploited.

99
00:04:33.365 --> 00:04:35.965
<00:04:33.365>147 <00:04:34.065>million <00:04:34.765>customers.

100
00:04:36.315 --> 00:04:39.325
<00:04:36.315>Data <00:04:36.490>was, <00:04:36.665>uh, <00:04:36.840>was <00:04:37.015>grabbed <00:04:37.190>as <00:04:37.365>part <00:04:37.540>of <00:04:37.715>that.

101
00:04:39.505 --> 00:04:42.205
<00:04:39.505>And <00:04:39.660>of <00:04:39.816>course, <00:04:39.971>we're <00:04:40.127>talking <00:04:40.282>out <00:04:40.438>about <00:04:40.593>really <00:04:40.749>big <00:04:40.905>examples

102
00:04:42.205 --> 00:04:44.685
<00:04:42.205>here, <00:04:42.380>but <00:04:42.555>regardless <00:04:42.729>of <00:04:42.905>the <00:04:43.080>size <00:04:43.255>of <00:04:43.430>our <00:04:43.604>applications,

103
00:04:45.105 --> 00:04:47.205
<00:04:45.105>the <00:04:45.305>threat <00:04:45.505>and <00:04:45.705>the <00:04:45.905>risk <00:04:46.105>remains <00:04:46.305>the <00:04:46.505>same.

104
00:04:47.625 --> 00:04:51.685
<00:04:47.625>So <00:04:47.752>we <00:04:47.879>use <00:04:48.006>this <00:04:48.134>phrase <00:04:48.261>shift <00:04:48.388>left <00:04:48.515>when <00:04:48.643>we <00:04:48.770>talk <00:04:48.897>about <00:04:49.025>security

105
00:04:51.685 --> 00:04:54.685
<00:04:51.685>vulnerabilities <00:04:51.885>to <00:04:52.085>talk <00:04:52.285>about <00:04:52.485>the <00:04:52.685>practice <00:04:52.885>of <00:04:53.085>finding

106
00:04:54.825 --> 00:04:58.365
<00:04:54.825>and <00:04:55.025>remediating <00:04:55.224>vulnerabilities <00:04:55.425>earlier <00:04:55.625>on <00:04:55.825>in <00:04:56.025>the <00:04:56.224>software

107
00:04:58.365 --> 00:05:00.325
<00:04:58.365>development <00:04:58.598>lifecycle <00:04:58.831>when <00:04:59.065>they <00:04:59.298>are <00:04:59.531>still <00:04:59.765>easier

108
00:05:00.465 --> 00:05:01.805
<00:05:00.465>and <00:05:00.866>cheaper <00:05:01.269>to <00:05:01.671>fix.

109
00:05:02.265 --> 00:05:05.205
<00:05:02.265>And <00:05:02.465>although <00:05:02.664>most <00:05:02.865>organizations <00:05:03.065>have <00:05:03.265>adopted <00:05:03.465>this <00:05:03.664>approach,

110
00:05:05.865 --> 00:05:08.325
<00:05:05.865>uh, <00:05:06.145>our <00:05:06.425>industry <00:05:06.705>overall <00:05:06.985>has <00:05:07.265>kind

111
00:05:08.325 --> 00:05:09.965
<00:05:08.325>of <00:05:08.558>fell <00:05:08.791>short <00:05:09.025>on <00:05:09.258>the <00:05:09.491>actual <00:05:09.724>needs.

112
00:05:10.165 --> 00:05:11.645
<00:05:10.165>A <00:05:10.387>lot <00:05:10.609>of <00:05:10.831>us <00:05:11.053>really <00:05:11.275>care <00:05:11.496>about

113
00:05:12.045 --> 00:05:13.245
<00:05:12.045>identifying <00:05:12.585>these <00:05:13.125>vulnerabilities.

114
00:05:13.755 --> 00:05:14.885
<00:05:13.755>That <00:05:14.009>is <00:05:14.263>not <00:05:14.517>the <00:05:14.772>need.

115
00:05:15.105 --> 00:05:17.245
<00:05:15.105>The <00:05:15.338>need <00:05:15.571>is <00:05:15.805>to <00:05:16.038>fix <00:05:16.271>the <00:05:16.505>vulnerabilities

116
00:05:17.385 --> 00:05:19.005
<00:05:17.385>before <00:05:17.735>they <00:05:18.085>become <00:05:18.435>a <00:05:18.784>problem.

117
00:05:19.745 --> 00:05:21.685
<00:05:19.745>And <00:05:19.920>that <00:05:20.095>sets <00:05:20.270>the <00:05:20.445>scene <00:05:20.620>for <00:05:20.795>our <00:05:20.970>talk <00:05:21.145>today.

118
00:05:22.145 --> 00:05:24.685
<00:05:22.145>Uh, <00:05:22.424>helping <00:05:22.705>developers <00:05:22.984>shift <00:05:23.265>left <00:05:23.544>with,

119
00:05:24.835 --> 00:05:26.525
<00:05:24.835>with <00:05:25.301>GitHub <00:05:25.768>security <00:05:26.234>tools.

120
00:05:26.985 --> 00:05:30.285
<00:05:26.985>We <00:05:27.125>have <00:05:27.265>the <00:05:27.405>privilege <00:05:27.545>at <00:05:27.685>GitHub <00:05:27.825>of <00:05:27.965>being <00:05:28.105>able <00:05:28.245>to <00:05:28.385>kind

121
00:05:30.285 --> 00:05:32.365
<00:05:30.285>of <00:05:30.635>embed <00:05:30.985>the <00:05:31.335>security <00:05:31.685>tools

122
00:05:32.425 --> 00:05:35.965
<00:05:32.425>and <00:05:32.658>practices <00:05:32.891>inside <00:05:33.125>of <00:05:33.358>developers' <00:05:33.591>existing <00:05:33.825>workflows

123
00:05:35.965 --> 00:05:38.325
<00:05:35.965>by <00:05:36.165>virtue <00:05:36.365>of <00:05:36.565>the <00:05:36.765>fact <00:05:36.965>that <00:05:37.165>a <00:05:37.365>lot

124
00:05:38.325 --> 00:05:40.965
<00:05:38.325>of <00:05:38.558>developers <00:05:38.791>already <00:05:39.025>use <00:05:39.258>GitHub <00:05:39.491>as <00:05:39.724>part

125
00:05:40.965 --> 00:05:41.965
<00:05:40.965>of <00:05:41.265>their <00:05:41.565>day-to-day <00:05:41.865>work.

126
00:05:42.425 --> 00:05:44.205
<00:05:42.425>Uh, <00:05:42.580>some <00:05:42.736>of <00:05:42.891>the <00:05:43.047>features <00:05:43.202>we're <00:05:43.358>gonna <00:05:43.513>talk <00:05:43.669>about <00:05:43.825>today

127
00:05:44.385 --> 00:05:45.525
<00:05:44.385>are <00:05:44.727>available <00:05:45.068>for <00:05:45.411>all.

128
00:05:45.875 --> 00:05:48.365
<00:05:45.875>Some <00:05:46.075>are <00:05:46.275>available <00:05:46.475>for <00:05:46.675>public <00:05:46.875>repositories <00:05:47.075>for <00:05:47.275>free,

129
00:05:48.365 --> 00:05:50.125
<00:05:48.365>some <00:05:48.598>are <00:05:48.831>part <00:05:49.065>of <00:05:49.298>GitHub <00:05:49.531>advanced <00:05:49.765>security.

130
00:05:50.465 --> 00:05:51.605
<00:05:50.465>I'm <00:05:50.670>gonna <00:05:50.875>focus <00:05:51.080>on <00:05:51.285>the <00:05:51.491>features.

131
00:05:51.605 --> 00:05:52.845
<00:05:51.605>If <00:05:51.791>you <00:05:51.977>wanna <00:05:52.163>talk <00:05:52.349>more <00:05:52.535>about <00:05:52.721>them

132
00:05:52.845 --> 00:05:54.765
<00:05:52.845>after <00:05:53.045>the <00:05:53.245>talk, <00:05:53.445>I'll <00:05:53.645>show <00:05:53.845>you <00:05:54.045>around <00:05:54.245>them.

133
00:05:54.765 --> 00:05:56.445
<00:05:54.765>I've <00:05:54.920>got <00:05:55.076>demos <00:05:55.231>for <00:05:55.387>most <00:05:55.542>of <00:05:55.698>them <00:05:55.853>ready <00:05:56.009>to <00:05:56.164>go

134
00:05:56.505 --> 00:05:58.125
<00:05:56.505>or <00:05:56.705>talk <00:05:56.905>about, <00:05:57.105>about <00:05:57.305>where <00:05:57.505>they <00:05:57.705>sit <00:05:57.905>in

135
00:05:58.125 --> 00:05:59.245
<00:05:58.125>that <00:05:58.377>kind <00:05:58.629>of <00:05:58.881>pricing <00:05:59.133>space.

136
00:05:59.475 --> 00:06:00.845
<00:05:59.475>I'll <00:05:59.721>be <00:05:59.968>somewhere <00:06:00.214>between <00:06:00.461>the <00:06:00.708>GitHub

137
00:06:00.845 --> 00:06:03.165
<00:06:00.845>and <00:06:01.000>the <00:06:01.156>Microsoft <00:06:01.311>booth <00:06:01.467>for <00:06:01.622>the <00:06:01.778>remainder <00:06:01.933>of <00:06:02.089>the <00:06:02.245>event.

138
00:06:03.825 --> 00:06:06.045
<00:06:03.825>So <00:06:04.058>firstly, <00:06:04.291>we're <00:06:04.525>gonna <00:06:04.758>talk <00:06:04.991>about <00:06:05.224>secrets.

139
00:06:06.305 --> 00:06:07.925
<00:06:06.305>So <00:06:06.585>secrets <00:06:06.865>just <00:06:07.145>a <00:06:07.425>level <00:06:07.705>set.

140
00:06:07.925 --> 00:06:11.965
<00:06:07.925>Here <00:06:08.065>is <00:06:08.205>this <00:06:08.345>kind <00:06:08.485>of <00:06:08.625>capture <00:06:08.765>term <00:06:08.905>for <00:06:09.045>tokens, <00:06:09.185>API, <00:06:09.325>keys,

141
00:06:12.725 --> 00:06:16.485
<00:06:12.725>passwords, <00:06:12.900>any <00:06:13.075>kind <00:06:13.250>of <00:06:13.425>sensitive <00:06:13.600>credential <00:06:13.775>that <00:06:13.950>is <00:06:14.125>used

142
00:06:16.485 --> 00:06:18.645
<00:06:16.485>to <00:06:16.835>identify <00:06:17.185>and <00:06:17.535>authenticate <00:06:17.885>users.

143
00:06:19.595 --> 00:06:22.765
<00:06:19.595>They <00:06:19.795>are <00:06:19.995>designed <00:06:20.195>to <00:06:20.395>obviously <00:06:20.595>stop <00:06:20.795>unauthorized <00:06:20.995>access.

144
00:06:22.985 --> 00:06:26.445
<00:06:22.985>But <00:06:23.160>what <00:06:23.335>happens <00:06:23.510>when <00:06:23.685>we <00:06:23.860>accidentally <00:06:24.035>make <00:06:24.210>them <00:06:24.385>visible?

145
00:06:26.915 --> 00:06:30.325
<00:06:26.915>Attackers <00:06:27.115>can <00:06:27.315>exploit <00:06:27.515>exposed <00:06:27.715>keys <00:06:27.915>in <00:06:28.115>an <00:06:28.315>automated

146
00:06:30.325 --> 00:06:31.605
<00:06:30.325>fashion <00:06:30.901>within <00:06:31.477>seconds.

147
00:06:32.185 --> 00:06:34.605
<00:06:32.185>And <00:06:32.340>you <00:06:32.496>might <00:06:32.651>think <00:06:32.807>to <00:06:32.962>yourself, <00:06:33.118>Hey, <00:06:33.273>look, <00:06:33.429>it's <00:06:33.585>fine.

148
00:06:34.845 --> 00:06:36.485
<00:06:34.845>I <00:06:35.195>just <00:06:35.545>use <00:06:35.895>private <00:06:36.245>repositories.

149
00:06:36.825 --> 00:06:39.685
<00:06:36.825>And <00:06:36.980>in <00:06:37.136>some <00:06:37.291>ways, <00:06:37.447>I <00:06:37.602>suppose <00:06:37.758>that <00:06:37.913>limits <00:06:38.069>some <00:06:38.224>risk,

150
00:06:40.105 --> 00:06:42.045
<00:06:40.105>but <00:06:40.338>it <00:06:40.571>now <00:06:40.805>increases <00:06:41.038>the <00:06:41.271>risk <00:06:41.505>of

151
00:06:42.045 --> 00:06:44.365
<00:06:42.045>what <00:06:42.245>happens <00:06:42.445>if <00:06:42.645>your <00:06:42.845>account <00:06:43.045>ever <00:06:43.245>becomes <00:06:43.445>compromised,

152
00:06:44.505 --> 00:06:47.245
<00:06:44.505>or <00:06:44.705>perhaps <00:06:44.905>in <00:06:45.105>future <00:06:45.305>you <00:06:45.505>flip <00:06:45.705>a <00:06:45.905>repository

153
00:06:47.305 --> 00:06:50.805
<00:06:47.305>to <00:06:47.538>be <00:06:47.771>public <00:06:48.005>in <00:06:48.238>visibility <00:06:48.471>intentionally, <00:06:48.705>uh,

154
00:06:50.805 --> 00:06:53.525
<00:06:50.805>and <00:06:50.980>forget <00:06:51.155>that <00:06:51.330>the <00:06:51.505>entire <00:06:51.680>Git <00:06:51.855>history <00:06:52.030>is <00:06:52.205>available

155
00:06:53.525 --> 00:06:55.005
<00:06:53.525>within <00:06:54.191>a <00:06:54.857>repository.

156
00:06:55.665 --> 00:06:57.205
<00:06:55.665>So <00:06:55.838>one <00:06:56.011>of <00:06:56.184>the <00:06:56.358>tools <00:06:56.531>we <00:06:56.704>have <00:06:56.877>to <00:06:57.051>help

157
00:06:57.205 --> 00:06:58.925
<00:06:57.205>with <00:06:57.484>this <00:06:57.765>is <00:06:58.044>called <00:06:58.325>push <00:06:58.604>protection.

158
00:06:59.315 --> 00:07:00.645
<00:06:59.315>This <00:06:59.614>is <00:06:59.913>a <00:07:00.212>feature <00:07:00.512>designed

159
00:07:00.665 --> 00:07:03.645
<00:07:00.665>to <00:07:00.840>stop <00:07:01.015>credentials <00:07:01.190>ever <00:07:01.365>being <00:07:01.540>pushed <00:07:01.715>from <00:07:01.890>your <00:07:02.065>machine

160
00:07:04.065 --> 00:07:06.325
<00:07:04.065>to <00:07:04.344>GitHub, <00:07:04.625>whether <00:07:04.905>that's <00:07:05.185>GitHub, <00:07:05.465>enterprise,

161
00:07:06.325 --> 00:07:08.365
<00:07:06.325>self-hosted <00:07:06.791>cloud, <00:07:07.258>or <00:07:07.724>github.com.

162
00:07:08.825 --> 00:07:10.925
<00:07:08.825>So <00:07:09.058>you <00:07:09.291>enable <00:07:09.525>this <00:07:09.758>on <00:07:09.991>a <00:07:10.224>repository

163
00:07:11.185 --> 00:07:14.685
<00:07:11.185>or <00:07:11.340>at <00:07:11.496>an <00:07:11.651>organization <00:07:11.807>level, <00:07:11.962>not <00:07:12.118>on <00:07:12.273>the <00:07:12.429>individual <00:07:12.585>machine.

164
00:07:15.185 --> 00:07:18.165
<00:07:15.185>And <00:07:15.312>what <00:07:15.439>it <00:07:15.566>will <00:07:15.694>do <00:07:15.821>is <00:07:15.948>proactively <00:07:16.075>scan <00:07:16.203>the <00:07:16.330>code <00:07:16.457>for <00:07:16.585>things

165
00:07:18.165 --> 00:07:20.845
<00:07:18.165>that <00:07:18.305>look <00:07:18.445>like <00:07:18.585>secrets <00:07:18.725>in <00:07:18.865>the <00:07:19.005>middle <00:07:19.145>of <00:07:19.285>the <00:07:19.425>push <00:07:19.565>process

166
00:07:21.385 --> 00:07:22.445
<00:07:21.385>and <00:07:21.703>then <00:07:22.021>reject <00:07:22.339>it.

167
00:07:22.665 --> 00:07:26.125
<00:07:22.665>If <00:07:22.805>it <00:07:22.945>finds <00:07:23.085>a <00:07:23.225>sensitive <00:07:23.365>value <00:07:23.505>within <00:07:23.645>your, <00:07:23.785>within <00:07:23.925>your <00:07:24.065>code.

168
00:07:26.545 --> 00:07:28.445
<00:07:26.545>Um, <00:07:26.745>it <00:07:26.945>shows <00:07:27.145>you <00:07:27.345>where <00:07:27.545>the <00:07:27.745>problem <00:07:27.945>is,

169
00:07:28.515 --> 00:07:30.765
<00:07:28.515>what <00:07:28.748>commit <00:07:28.981>it <00:07:29.215>might <00:07:29.448>be <00:07:29.681>in <00:07:29.914>not,

170
00:07:30.905 --> 00:07:32.725
<00:07:30.905>it <00:07:31.080>might <00:07:31.255>be <00:07:31.429>in <00:07:31.604>the <00:07:31.780>commit <00:07:31.955>it <00:07:32.130>is <00:07:32.304>in,

171
00:07:32.905 --> 00:07:35.045
<00:07:32.905>and <00:07:33.060>then <00:07:33.216>gives <00:07:33.371>you <00:07:33.527>steps <00:07:33.682>on <00:07:33.838>how <00:07:33.993>to <00:07:34.149>remove <00:07:34.304>it

172
00:07:35.045 --> 00:07:37.085
<00:07:35.045>before <00:07:35.220>you <00:07:35.395>go <00:07:35.570>ahead <00:07:35.745>and <00:07:35.920>try <00:07:36.095>and <00:07:36.270>push <00:07:36.445>again.

173
00:07:37.705 --> 00:07:40.565
<00:07:37.705>What's <00:07:37.844>really <00:07:37.984>nice <00:07:38.125>about <00:07:38.265>this <00:07:38.405>is <00:07:38.544>it <00:07:38.685>does <00:07:38.825>not <00:07:38.965>require <00:07:39.104>each

174
00:07:40.565 --> 00:07:43.205
<00:07:40.565>developer <00:07:40.844>to <00:07:41.125>have <00:07:41.405>actually <00:07:41.685>successfully <00:07:41.965>set

175
00:07:43.205 --> 00:07:44.325
<00:07:43.205>something <00:07:43.406>up <00:07:43.608>on <00:07:43.809>their <00:07:44.011>own <00:07:44.212>machine.

176
00:07:44.625 --> 00:07:47.725
<00:07:44.625>It <00:07:44.752>is <00:07:44.879>set <00:07:45.006>up <00:07:45.134>again <00:07:45.261>at <00:07:45.388>a <00:07:45.515>repository <00:07:45.643>or <00:07:45.770>an <00:07:45.897>organization <00:07:46.025>level,

177
00:07:48.065 --> 00:07:50.125
<00:07:48.065>and <00:07:48.344>then <00:07:48.625>the <00:07:48.905>get <00:07:49.185>push, <00:07:49.465>the,

178
00:07:50.545 --> 00:07:53.165
<00:07:50.545>the <00:07:50.778>command <00:07:51.011>we <00:07:51.245>already <00:07:51.478>use <00:07:51.711>fails <00:07:51.945>out

179
00:07:53.165 --> 00:07:55.885
<00:07:53.165>with <00:07:53.340>a <00:07:53.515>reason <00:07:53.690>why <00:07:53.865>it's <00:07:54.040>not <00:07:54.215>remembering <00:07:54.390>another <00:07:54.565>step.

180
00:07:55.915 --> 00:07:58.885
<00:07:55.915>It's <00:07:56.115>not <00:07:56.315>adding <00:07:56.515>more <00:07:56.715>friction, <00:07:56.915>uh, <00:07:57.115>to <00:07:57.315>try

181
00:07:58.885 --> 00:07:59.925
<00:07:58.885>and <00:07:59.197>catch <00:07:59.509>those <00:07:59.821>secrets.

182
00:07:59.925 --> 00:08:01.005
<00:07:59.925>It <00:08:00.249>just <00:08:00.573>fails <00:08:00.897>out.

183
00:08:01.585 --> 00:08:03.525
<00:08:01.585>Now, <00:08:01.740>if <00:08:01.896>you <00:08:02.051>believe <00:08:02.207>it's <00:08:02.362>safe <00:08:02.518>to <00:08:02.673>expose <00:08:02.829>the <00:08:02.984>secret

184
00:08:03.545 --> 00:08:05.445
<00:08:03.545>for <00:08:03.720>some <00:08:03.895>reason, <00:08:04.070>it <00:08:04.245>might <00:08:04.420>be <00:08:04.595>used <00:08:04.770>in <00:08:04.945>testing

185
00:08:05.665 --> 00:08:08.285
<00:08:05.665>or <00:08:05.865>it <00:08:06.065>might <00:08:06.265>not <00:08:06.465>be <00:08:06.665>a <00:08:06.865>sensitive <00:08:07.065>value

186
00:08:08.285 --> 00:08:10.085
<00:08:08.285>that <00:08:08.635>can't <00:08:08.985>be <00:08:09.335>shown <00:08:09.685>publicly.

187
00:08:10.465 --> 00:08:13.325
<00:08:10.465>You <00:08:10.640>can <00:08:10.815>bypass <00:08:10.989>this <00:08:11.164>block, <00:08:11.340>uh, <00:08:11.515>from <00:08:11.690>the <00:08:11.864>web.

188
00:08:13.705 --> 00:08:16.405
<00:08:13.705>Uh, <00:08:13.905>you <00:08:14.104>can <00:08:14.305>also <00:08:14.505>lock <00:08:14.705>this <00:08:14.905>bypassing <00:08:15.104>functionality

189
00:08:16.585 --> 00:08:18.405
<00:08:16.585>to <00:08:16.864>just <00:08:17.145>certain <00:08:17.424>teams <00:08:17.705>or <00:08:17.984>roles.

190
00:08:18.785 --> 00:08:21.965
<00:08:18.785>So <00:08:18.912>perhaps <00:08:19.039>a <00:08:19.166>developer <00:08:19.294>has <00:08:19.421>to <00:08:19.548>provide <00:08:19.675>a <00:08:19.803>reason <00:08:19.930>why <00:08:20.057>they <00:08:20.185>want

191
00:08:21.965 --> 00:08:24.965
<00:08:21.965>to <00:08:22.164>bypass <00:08:22.364>the <00:08:22.565>push, <00:08:22.765>uh, <00:08:22.965>the <00:08:23.164>push <00:08:23.364>protection,

192
00:08:25.185 --> 00:08:26.765
<00:08:25.185>and <00:08:25.418>then <00:08:25.651>someone <00:08:25.885>has <00:08:26.118>to <00:08:26.351>approve <00:08:26.585>that

193
00:08:26.765 --> 00:08:28.885
<00:08:26.765>before <00:08:26.965>they're <00:08:27.164>allowed <00:08:27.365>to <00:08:27.565>try <00:08:27.765>and <00:08:27.965>push <00:08:28.164>again.

194
00:08:29.955 --> 00:08:32.775
<00:08:29.955>We <00:08:30.155>work <00:08:30.354>with <00:08:30.555>over <00:08:30.755>150 <00:08:30.955>different <00:08:31.155>token <00:08:31.354>providers

195
00:08:32.775 --> 00:08:36.135
<00:08:32.775>to <00:08:32.975>understand <00:08:33.174>the <00:08:33.375>patterns <00:08:33.574>of <00:08:33.775>their <00:08:33.975>tokens, <00:08:34.174>uh,

196
00:08:36.475 --> 00:08:40.175
<00:08:36.475>and <00:08:36.615>the <00:08:36.755>secrets <00:08:36.895>that <00:08:37.034>they <00:08:37.175>use <00:08:37.315>to <00:08:37.455>authenticate <00:08:37.595>users <00:08:37.735>as <00:08:37.875>well

197
00:08:40.195 --> 00:08:42.815
<00:08:40.195>as, <00:08:40.428>uh, <00:08:40.661>a <00:08:40.895>set <00:08:41.128>of <00:08:41.361>other <00:08:41.595>known

198
00:08:43.035 --> 00:08:45.175
<00:08:43.034>but <00:08:43.501>non-provider <00:08:43.968>specific <00:08:44.435>secrets.

199
00:08:45.175 --> 00:08:48.255
<00:08:45.175>So <00:08:45.375>we're <00:08:45.574>talking <00:08:45.775>things <00:08:45.974>like <00:08:46.175>database <00:08:46.375>connection <00:08:46.574>strings

200
00:08:48.275 --> 00:08:49.615
<00:08:48.275>or <00:08:48.677>secret <00:08:49.079>keys, <00:08:49.481>right?

201
00:08:49.615 --> 00:08:51.255
<00:08:49.615>They're <00:08:50.081>not <00:08:50.548>provider <00:08:51.015>specific,

202
00:08:51.435 --> 00:08:52.855
<00:08:51.435>but <00:08:51.647>they <00:08:51.861>do <00:08:52.074>have <00:08:52.287>a <00:08:52.500>similar <00:08:52.713>pattern.

203
00:08:53.155 --> 00:08:54.975
<00:08:53.155>So <00:08:53.355>all <00:08:53.555>of <00:08:53.755>this <00:08:53.954>sits <00:08:54.155>within <00:08:54.355>this <00:08:54.555>kind

204
00:08:55.085 --> 00:08:57.005
<00:08:55.085>of <00:08:55.551>supported <00:08:56.018>patterns <00:08:56.485>area.

205
00:08:57.555 --> 00:09:00.325
<00:08:57.555>Organizations <00:08:57.788>can <00:08:58.021>also <00:08:58.255>set <00:08:58.488>up <00:08:58.721>custom <00:08:58.954>patterns.

206
00:09:00.545 --> 00:09:03.925
<00:09:00.545>You <00:09:00.700>might <00:09:00.856>have <00:09:01.011>an <00:09:01.167>unusual <00:09:01.322>pattern <00:09:01.478>for <00:09:01.633>your <00:09:01.789>internal <00:09:01.944>secrets.

207
00:09:04.105 --> 00:09:05.285
<00:09:04.105>So <00:09:04.370>you <00:09:04.636>can <00:09:04.901>specify <00:09:05.166>that

208
00:09:05.285 --> 00:09:07.525
<00:09:05.285>with <00:09:05.635>everyone's <00:09:05.985>favorite <00:09:06.334>regular <00:09:06.685>expressions.

209
00:09:07.885 --> 00:09:09.125
<00:09:07.885>I <00:09:08.044>think <00:09:08.203>we <00:09:08.363>have <00:09:08.522>a <00:09:08.682>generator <00:09:08.841>to <00:09:09.001>help

210
00:09:09.125 --> 00:09:10.165
<00:09:09.125>you <00:09:09.437>actually <00:09:09.749>create <00:09:10.060>those.

211
00:09:10.625 --> 00:09:13.165
<00:09:10.625>Um, <00:09:10.800>and <00:09:10.975>then <00:09:11.150>they <00:09:11.325>can <00:09:11.500>also <00:09:11.675>be <00:09:11.850>included <00:09:12.025>inside

212
00:09:13.345 --> 00:09:14.685
<00:09:13.345>of <00:09:13.948>secret <00:09:14.550>patterns.

213
00:09:15.305 --> 00:09:18.445
<00:09:15.305>Uh, <00:09:15.505>finally, <00:09:15.704>you <00:09:15.905>can <00:09:16.104>enable <00:09:16.305>copilot <00:09:16.505>powered <00:09:16.704>generic

214
00:09:18.745 --> 00:09:19.925
<00:09:18.745>key <00:09:19.807>identification.

215
00:09:20.505 --> 00:09:24.405
<00:09:20.505>Um, <00:09:20.632>and <00:09:20.759>what <00:09:20.886>this <00:09:21.014>will <00:09:21.141>do <00:09:21.268>is <00:09:21.395>kind <00:09:21.523>of <00:09:21.650>scan <00:09:21.777>your <00:09:21.905>codes

216
00:09:24.405 --> 00:09:27.005
<00:09:24.405>for <00:09:24.605>anything <00:09:24.805>that <00:09:25.005>could <00:09:25.204>be <00:09:25.405>a <00:09:25.605>secret, <00:09:25.805>right?

217
00:09:27.005 --> 00:09:29.965
<00:09:27.005>That <00:09:27.180>isn't <00:09:27.355>necessarily <00:09:27.530>a <00:09:27.705>defined <00:09:27.880>pattern <00:09:28.055>in <00:09:28.230>our <00:09:28.405>supported

218
00:09:29.965 --> 00:09:31.605
<00:09:29.965>patterns <00:09:30.315>or <00:09:30.665>a <00:09:31.015>custom <00:09:31.365>pattern.

219
00:09:32.095 --> 00:09:33.805
<00:09:32.095>Looks <00:09:32.295>like <00:09:32.495>it <00:09:32.695>might <00:09:32.895>be <00:09:33.095>sensitive <00:09:33.295>like <00:09:33.495>a

220
00:09:33.965 --> 00:09:35.045
<00:09:33.965>password, <00:09:34.289>for <00:09:34.613>example, <00:09:34.937>right?

221
00:09:35.075 --> 00:09:36.885
<00:09:35.075>This <00:09:35.230>is <00:09:35.386>just <00:09:35.541>kind <00:09:35.697>of <00:09:35.852>a <00:09:36.008>random <00:09:36.163>string <00:09:36.319>of <00:09:36.475>keys.

222
00:09:37.065 --> 00:09:39.885
<00:09:37.065>And <00:09:37.240>there <00:09:37.415>are <00:09:37.590>steps <00:09:37.765>taken <00:09:37.940>within <00:09:38.115>this <00:09:38.290>product, <00:09:38.465>uh,

223
00:09:39.885 --> 00:09:43.245
<00:09:39.885>within <00:09:40.040>this <00:09:40.196>feature <00:09:40.351>that <00:09:40.507>you <00:09:40.662>can <00:09:40.818>enable <00:09:40.973>opt <00:09:41.129>in, <00:09:41.285>uh,

224
00:09:43.385 --> 00:09:45.765
<00:09:43.385>to <00:09:43.735>also <00:09:44.085>avoid <00:09:44.435>force <00:09:44.785>positives.

225
00:09:46.635 --> 00:09:49.085
<00:09:46.635>This <00:09:46.868>is <00:09:47.101>what <00:09:47.335>a <00:09:47.568>secret <00:09:47.801>scanning <00:09:48.035>alert

226
00:09:49.085 --> 00:09:50.325
<00:09:49.085>looks <00:09:49.457>like <00:09:49.829>for <00:09:50.201>organizations.

227
00:09:50.665 --> 00:09:52.525
<00:09:50.665>You <00:09:50.839>can <00:09:51.015>see <00:09:51.189>here <00:09:51.365>that <00:09:51.540>there <00:09:51.714>are <00:09:51.890>four <00:09:52.064>secrets

228
00:09:52.525 --> 00:09:53.765
<00:09:52.525>that <00:09:52.896>have <00:09:53.269>been <00:09:53.641>identified.

229
00:09:54.065 --> 00:09:56.285
<00:09:54.065>It, <00:09:54.220>it <00:09:54.376>tells <00:09:54.531>you <00:09:54.687>what <00:09:54.842>kind <00:09:54.998>of <00:09:55.153>secret <00:09:55.309>they <00:09:55.465>are,

230
00:09:56.285 --> 00:09:59.965
<00:09:56.285>so <00:09:56.459>you <00:09:56.635>understand, <00:09:56.810>uh, <00:09:56.985>understand <00:09:57.160>what <00:09:57.334>might <00:09:57.510>be <00:09:57.685>compromised.

231
00:10:00.225 --> 00:10:03.165
<00:10:00.225>And <00:10:00.400>also <00:10:00.575>explicitly <00:10:00.750>flags <00:10:00.925>which <00:10:01.100>ones <00:10:01.275>are <00:10:01.450>public <00:10:01.625>leak

232
00:10:03.185 --> 00:10:04.565
<00:10:03.185>so <00:10:03.433>you <00:10:03.681>can <00:10:03.930>take <00:10:04.178>quicker <00:10:04.427>action.

233
00:10:04.825 --> 00:10:07.085
<00:10:04.825>You'll <00:10:04.965>also <00:10:05.105>notice <00:10:05.245>here <00:10:05.385>at <00:10:05.525>the <00:10:05.665>side <00:10:05.805>there <00:10:05.945>is <00:10:06.085>a <00:10:06.225>difference

234
00:10:07.085 --> 00:10:10.125
<00:10:07.085>between <00:10:07.285>the <00:10:07.485>supported <00:10:07.685>patterns <00:10:07.885>and <00:10:08.085>the <00:10:08.285>custom <00:10:08.485>patterns

235
00:10:10.425 --> 00:10:14.245
<00:10:10.425>and <00:10:10.625>the <00:10:10.824>generic <00:10:11.025>AI <00:10:11.224>supported <00:10:11.425>identification <00:10:11.625>of <00:10:11.824>patterns

236
00:10:14.275 --> 00:10:16.565
<00:10:14.275>because <00:10:14.449>they <00:10:14.625>need <00:10:14.800>a <00:10:14.975>different <00:10:15.150>kind <00:10:15.324>of <00:10:15.500>triaging, <00:10:15.675>right?

237
00:10:16.785 --> 00:10:18.725
<00:10:16.785>For <00:10:16.959>this <00:10:17.135>second <00:10:17.310>set, <00:10:17.485>there <00:10:17.660>is <00:10:17.834>also <00:10:18.010>a <00:10:18.185>need

238
00:10:18.725 --> 00:10:20.685
<00:10:18.725>to <00:10:19.005>understand, <00:10:19.285>hey, <00:10:19.565>what <00:10:19.845>is <00:10:20.125>this?

239
00:10:20.985 --> 00:10:23.885
<00:10:20.985>Uh, <00:10:21.101>what <00:10:21.218>is <00:10:21.335>this <00:10:21.451>before <00:10:21.568>you <00:10:21.685>go <00:10:21.801>ahead <00:10:21.918>and <00:10:22.035>actually <00:10:22.151>act <00:10:22.268>on <00:10:22.385>it?

240
00:10:24.865 --> 00:10:26.245
<00:10:24.865>So <00:10:25.279>what <00:10:25.693>about <00:10:26.107>secrets

241
00:10:26.245 --> 00:10:29.205
<00:10:26.245>that <00:10:26.420>might <00:10:26.595>already <00:10:26.770>be <00:10:26.945>in <00:10:27.120>your <00:10:27.295>code <00:10:27.470>base, <00:10:27.645>right?

242
00:10:29.225 --> 00:10:30.805
<00:10:29.225>And <00:10:29.425>it <00:10:29.625>could <00:10:29.825>be, <00:10:30.025>uh, <00:10:30.225>it <00:10:30.425>could <00:10:30.625>be

243
00:10:30.805 --> 00:10:32.085
<00:10:30.805>that <00:10:30.997>they <00:10:31.189>were <00:10:31.381>in <00:10:31.573>your <00:10:31.765>code <00:10:31.957>base

244
00:10:32.085 --> 00:10:33.885
<00:10:32.085>before <00:10:32.318>you <00:10:32.551>enabled <00:10:32.785>this <00:10:33.018>feature, <00:10:33.251>for <00:10:33.485>example,

245
00:10:33.885 --> 00:10:36.445
<00:10:33.885>that <00:10:34.040>they've <00:10:34.196>somehow <00:10:34.351>found <00:10:34.507>their <00:10:34.662>way <00:10:34.818>in <00:10:34.973>some <00:10:35.129>other <00:10:35.285>way.

246
00:10:36.825 --> 00:10:39.885
<00:10:36.825>Secret <00:10:37.058>scanning <00:10:37.291>also <00:10:37.525>extends <00:10:37.758>beyond <00:10:37.991>push <00:10:38.225>protection

247
00:10:40.105 --> 00:10:44.005
<00:10:40.105>and <00:10:40.260>covers <00:10:40.416>your <00:10:40.571>entire <00:10:40.727>GI <00:10:40.882>history <00:10:41.038>on <00:10:41.193>all <00:10:41.349>branches, <00:10:41.505>titles,

248
00:10:44.005 --> 00:10:48.565
<00:10:44.005>descriptions <00:10:44.180>and <00:10:44.355>comments <00:10:44.530>on <00:10:44.705>issues, <00:10:44.880>pool <00:10:45.055>requests, <00:10:45.230>um, <00:10:45.405>uh,

249
00:10:48.565 --> 00:10:51.965
<00:10:48.565>discussions, <00:10:48.720>uh, <00:10:48.876>and <00:10:49.031>also <00:10:49.187>in <00:10:49.342>wikis <00:10:49.498>if <00:10:49.653>you <00:10:49.809>use <00:10:49.965>wikis.

250
00:10:52.025 --> 00:10:53.765
<00:10:52.025>So <00:10:52.225>we'll <00:10:52.425>be <00:10:52.625>searching <00:10:52.824>for <00:10:53.025>those <00:10:53.225>as <00:10:53.425>well.

251
00:10:54.065 --> 00:10:55.925
<00:10:54.065>And <00:10:54.298>then <00:10:54.531>we <00:10:54.765>work <00:10:54.998>with <00:10:55.231>relevant <00:10:55.465>partners

252
00:10:55.925 --> 00:10:59.005
<00:10:55.925>where <00:10:56.080>it's <00:10:56.236>a <00:10:56.391>partners, <00:10:56.547>you <00:10:56.702>know, <00:10:56.858>a <00:10:57.013>partner <00:10:57.169>supported <00:10:57.324>pattern

253
00:10:59.385 --> 00:11:01.845
<00:10:59.385>to <00:10:59.560>tell <00:10:59.735>them <00:10:59.910>when <00:11:00.085>a <00:11:00.260>key <00:11:00.435>has <00:11:00.610>been <00:11:00.785>leaked.

254
00:11:02.065 --> 00:11:04.125
<00:11:02.065>Uh, <00:11:02.220>I <00:11:02.376>have <00:11:02.531>been <00:11:02.687>on <00:11:02.842>the <00:11:02.998>receiving <00:11:03.153>end <00:11:03.309>of <00:11:03.465>this,

255
00:11:04.365 --> 00:11:05.645
<00:11:04.365>I <00:11:04.941>think <00:11:05.516>unintentionally.

256
00:11:05.645 --> 00:11:08.605
<00:11:05.645>Before <00:11:05.819>I <00:11:05.995>joined <00:11:06.170>GitHub, <00:11:06.345>I <00:11:06.520>pushed <00:11:06.694>the <00:11:06.870>key <00:11:07.045>accidentally.

257
00:11:08.925 --> 00:11:11.405
<00:11:08.925>I <00:11:09.080>immediately <00:11:09.236>got <00:11:09.391>an <00:11:09.547>email <00:11:09.702>from <00:11:09.858>the <00:11:10.013>vendor <00:11:10.169>being <00:11:10.324>like,

258
00:11:11.465 --> 00:11:12.765
<00:11:11.465>Hey, <00:11:11.757>you <00:11:12.050>pushed <00:11:12.342>the <00:11:12.635>key.

259
00:11:13.075 --> 00:11:14.885
<00:11:13.075>It's <00:11:13.308>gone. <00:11:13.541>We <00:11:13.775>invalidated <00:11:14.008>it <00:11:14.241>for <00:11:14.475>you.

260
00:11:14.945 --> 00:11:17.805
<00:11:14.945>You <00:11:15.052>need <00:11:15.160>to <00:11:15.268>go <00:11:15.375>in, <00:11:15.483>cycle <00:11:15.591>it, <00:11:15.698>get <00:11:15.806>a <00:11:15.914>new <00:11:16.021>one <00:11:16.129>and <00:11:16.237>replace <00:11:16.345>it.

261
00:11:17.945 --> 00:11:19.845
<00:11:17.945>So <00:11:18.145>that <00:11:18.345>was <00:11:18.545>done <00:11:18.745>in <00:11:18.945>an <00:11:19.145>automated <00:11:19.345>fashion.

262
00:11:20.245 --> 00:11:23.005
<00:11:20.245>I <00:11:20.445>think <00:11:20.645>it <00:11:20.845>was <00:11:21.045>using <00:11:21.245>this <00:11:21.445>system, <00:11:21.645>um,

263
00:11:24.025 --> 00:11:25.845
<00:11:24.025>to <00:11:24.305>stop <00:11:24.584>the <00:11:24.865>key <00:11:25.145>being <00:11:25.425>exploited.

264
00:11:26.065 --> 00:11:27.925
<00:11:26.065>And <00:11:26.205>yes, <00:11:26.345>there <00:11:26.485>was <00:11:26.625>a <00:11:26.765>bit <00:11:26.905>of <00:11:27.045>an <00:11:27.185>interruption <00:11:27.325>for <00:11:27.465>me,

265
00:11:27.925 --> 00:11:29.165
<00:11:27.925>but <00:11:28.204>I'd <00:11:28.483>rather <00:11:28.762>an <00:11:29.040>interruption.

266
00:11:29.165 --> 00:11:32.645
<00:11:29.165>And <00:11:29.305>my <00:11:29.444>key <00:11:29.584>was <00:11:29.724>never, <00:11:29.865>uh, <00:11:30.005>never <00:11:30.145>exploited <00:11:30.285>than <00:11:30.425>allowing <00:11:30.564>it

267
00:11:32.645 --> 00:11:33.765
<00:11:32.645>to <00:11:32.896>be <00:11:33.149>in <00:11:33.401>the <00:11:33.653>public.

268
00:11:34.225 --> 00:11:35.285
<00:11:34.225>Uh, <00:11:34.702>in <00:11:35.179>2024,

269
00:11:35.305 --> 00:11:37.925
<00:11:35.305>we <00:11:35.479>found <00:11:35.655>nearly <00:11:35.829>40 <00:11:36.005>million <00:11:36.180>secret <00:11:36.354>leaks <00:11:36.530>across <00:11:36.704>all

270
00:11:37.925 --> 00:11:39.805
<00:11:37.925>of <00:11:38.158>these <00:11:38.391>sources, <00:11:38.625>which <00:11:38.858>then <00:11:39.091>allowed <00:11:39.324>developers

271
00:11:39.805 --> 00:11:43.445
<00:11:39.805>to <00:11:40.084>correctly <00:11:40.364>remediate <00:11:40.645>those <00:11:40.925>issues <00:11:41.204>issues.

272
00:11:43.445 --> 00:11:46.885
<00:11:43.445>GitHub <00:11:43.645>also <00:11:43.845>provides <00:11:44.045>a <00:11:44.245>secret <00:11:44.445>risk <00:11:44.645>assessment <00:11:44.845>report,

273
00:11:47.055 --> 00:11:50.245
<00:11:47.055>which <00:11:47.229>you <00:11:47.405>can <00:11:47.579>generate, <00:11:47.755>uh, <00:11:47.930>as <00:11:48.104>an <00:11:48.280>organization <00:11:48.454>owner

274
00:11:50.345 --> 00:11:54.445
<00:11:50.345>or <00:11:50.500>a <00:11:50.656>security <00:11:50.811>manager <00:11:50.967>to <00:11:51.122>evaluate <00:11:51.278>the <00:11:51.433>exposure <00:11:51.589>of <00:11:51.745>secrets

275
00:11:54.445 --> 00:11:55.965
<00:11:54.445>that <00:11:54.718>you <00:11:54.992>have <00:11:55.265>within <00:11:55.539>your <00:11:55.813>organization.

276
00:11:56.345 --> 00:11:58.885
<00:11:56.345>So <00:11:56.500>this <00:11:56.656>is <00:11:56.811>an <00:11:56.967>on <00:11:57.122>demand <00:11:57.278>point <00:11:57.433>in <00:11:57.589>time <00:11:57.745>check.

277
00:11:58.955 --> 00:12:00.365
<00:11:58.955>It's <00:11:59.208>not <00:11:59.462>like <00:11:59.716>an <00:11:59.970>ongoing <00:12:00.224>thing.

278
00:12:00.365 --> 00:12:03.525
<00:12:00.365>You <00:12:00.492>can <00:12:00.619>go <00:12:00.746>in <00:12:00.874>right <00:12:01.001>now <00:12:01.128>and, <00:12:01.255>and <00:12:01.383>run <00:12:01.510>this <00:12:01.637>check, <00:12:01.765>um,

279
00:12:03.525 --> 00:12:06.445
<00:12:03.525>and <00:12:03.665>it <00:12:03.805>will <00:12:03.944>show <00:12:04.084>you, <00:12:04.225>uh, <00:12:04.365>how <00:12:04.505>many <00:12:04.645>secrets <00:12:04.785>have <00:12:04.925>leaked,

280
00:12:06.445 --> 00:12:09.325
<00:12:06.445>what <00:12:06.600>kind <00:12:06.756>of <00:12:06.911>secrets <00:12:07.067>there <00:12:07.222>are <00:12:07.378>there, <00:12:07.533>there <00:12:07.689>are, <00:12:07.845>uh,

281
00:12:09.325 --> 00:12:10.365
<00:12:09.325>whether <00:12:09.559>they're <00:12:09.793>public <00:12:10.027>or <00:12:10.261>not,

282
00:12:10.425 --> 00:12:12.605
<00:12:10.425>and <00:12:10.775>then <00:12:11.125>steps <00:12:11.474>for <00:12:11.824>remediation.

283
00:12:12.785 --> 00:12:14.565
<00:12:12.785>So <00:12:12.925>if <00:12:13.064>there's <00:12:13.204>one <00:12:13.344>thing <00:12:13.485>you're <00:12:13.625>gonna <00:12:13.765>do <00:12:13.905>at <00:12:14.045>the <00:12:14.185>end

284
00:12:14.565 --> 00:12:16.165
<00:12:14.565>of <00:12:14.740>this <00:12:14.915>talk, <00:12:15.090>you're <00:12:15.265>gonna <00:12:15.440>go <00:12:15.615>into <00:12:15.790>your <00:12:15.965>org.

285
00:12:16.165 --> 00:12:17.725
<00:12:16.165>You're <00:12:16.398>gonna <00:12:16.631>run <00:12:16.865>a <00:12:17.098>secret <00:12:17.331>risk <00:12:17.564>assessment,

286
00:12:17.785 --> 00:12:19.045
<00:12:17.785>and <00:12:17.973>at <00:12:18.163>least <00:12:18.352>get <00:12:18.540>a <00:12:18.730>vibe <00:12:18.919>for

287
00:12:19.045 --> 00:12:20.125
<00:12:19.045>where <00:12:19.288>you <00:12:19.531>are <00:12:19.774>currently <00:12:20.017>standing,

288
00:12:20.385 --> 00:12:22.285
<00:12:20.385>and <00:12:20.585>perhaps <00:12:20.785>you're <00:12:20.985>gonna <00:12:21.185>slink <00:12:21.385>off <00:12:21.585>somewhere <00:12:21.785>quiet

289
00:12:22.305 --> 00:12:23.485
<00:12:22.305>and <00:12:22.570>go <00:12:22.836>act <00:12:23.101>on <00:12:23.367>that.

290
00:12:23.945 --> 00:12:26.845
<00:12:23.945>Um, <00:12:24.072>it's <00:12:24.199>really <00:12:24.326>nice. <00:12:24.454>We <00:12:24.581>also <00:12:24.708>provide, <00:12:24.835>uh, <00:12:24.963>as <00:12:25.090>I <00:12:25.217>said, <00:12:25.345>um,

291
00:12:28.285 --> 00:12:31.365
<00:12:28.285>insights <00:12:28.635>and <00:12:28.985>recommendations <00:12:29.334>for <00:12:29.685>remediation.

292
00:12:32.185 --> 00:12:35.405
<00:12:32.185>So <00:12:32.418>in <00:12:32.651>brief, <00:12:32.885>that <00:12:33.118>is <00:12:33.351>secret <00:12:33.584>protection,

293
00:12:35.965 --> 00:12:39.045
<00:12:35.965>stopping <00:12:36.120>ideally <00:12:36.276>your <00:12:36.431>keys <00:12:36.587>ever <00:12:36.742>making <00:12:36.898>it <00:12:37.053>into <00:12:37.209>being <00:12:37.365>visible

294
00:12:39.385 --> 00:12:40.525
<00:12:39.385>and <00:12:39.898>alerting <00:12:40.411>you

295
00:12:40.665 --> 00:12:42.685
<00:12:40.665>and <00:12:40.944>partners <00:12:41.224>proactively <00:12:41.505>when <00:12:41.785>they <00:12:42.064>are

296
00:12:42.705 --> 00:12:44.445
<00:12:42.705>to <00:12:43.055>stop <00:12:43.405>them <00:12:43.755>being <00:12:44.105>exploited.

297
00:12:45.265 --> 00:12:48.475
<00:12:45.265>Next <00:12:45.465>we're <00:12:45.665>gonna <00:12:45.865>talk <00:12:46.064>about <00:12:46.265>writing <00:12:46.465>secure <00:12:46.665>code,

298
00:12:48.815 --> 00:12:50.715
<00:12:48.815>and <00:12:49.048>we're <00:12:49.281>gonna <00:12:49.515>start <00:12:49.748>with <00:12:49.981>copilot, <00:12:50.215>right?

299
00:12:50.895 --> 00:12:53.715
<00:12:50.895>Uh, <00:12:51.022>we'll <00:12:51.149>come <00:12:51.276>onto <00:12:51.404>some <00:12:51.531>more <00:12:51.658>specialized <00:12:51.785>tools <00:12:51.913>in <00:12:52.040>the <00:12:52.167>MO <00:12:52.295>in

300
00:12:53.715 --> 00:12:56.555
<00:12:53.715>a <00:12:53.855>moment, <00:12:53.995>but <00:12:54.135>if <00:12:54.275>you've <00:12:54.415>used <00:12:54.555>copilot <00:12:54.695>in <00:12:54.835>your <00:12:54.975>code <00:12:55.115>editor

301
00:12:56.615 --> 00:12:59.755
<00:12:56.615>before, <00:12:56.770>um, <00:12:56.926>you <00:12:57.081>are <00:12:57.237>probably <00:12:57.392>familiar <00:12:57.548>with <00:12:57.703>this <00:12:57.859>little <00:12:58.015>pane,

302
00:12:59.755 --> 00:13:01.675
<00:12:59.755>you <00:12:59.955>can <00:13:00.155>open <00:13:00.355>up <00:13:00.555>on <00:13:00.755>the <00:13:00.955>side, <00:13:01.155>uh,

303
00:13:01.675 --> 00:13:03.395
<00:13:01.675>and <00:13:01.908>start <00:13:02.141>having <00:13:02.375>a <00:13:02.608>chat <00:13:02.841>with <00:13:03.074>copilot.

304
00:13:03.615 --> 00:13:05.955
<00:13:03.615>Now, <00:13:03.742>there <00:13:03.869>are <00:13:03.996>a <00:13:04.124>few <00:13:04.251>modes <00:13:04.378>that <00:13:04.505>we <00:13:04.633>have <00:13:04.760>within <00:13:04.887>that, <00:13:05.015>some

305
00:13:05.955 --> 00:13:08.675
<00:13:05.955>of <00:13:06.130>them <00:13:06.305>right <00:13:06.480>code, <00:13:06.655>some <00:13:06.830>of <00:13:07.005>them <00:13:07.180>answer <00:13:07.355>questions.

306
00:13:08.975 --> 00:13:11.595
<00:13:08.975>And <00:13:09.130>here <00:13:09.286>I'm <00:13:09.441>pointing <00:13:09.597>out <00:13:09.752>ask <00:13:09.908>mode, <00:13:10.063>which <00:13:10.219>is, <00:13:10.375>uh,

307
00:13:11.595 --> 00:13:14.195
<00:13:11.595>often <00:13:11.795>the <00:13:11.995>default <00:13:12.195>when <00:13:12.395>you <00:13:12.595>open <00:13:12.795>it <00:13:12.995>here.

308
00:13:14.215 --> 00:13:17.835
<00:13:14.215>You <00:13:14.370>can <00:13:14.526>ask <00:13:14.681>co-pilot <00:13:14.837>questions <00:13:14.992>about <00:13:15.148>your <00:13:15.303>code <00:13:15.459>base, <00:13:15.615>uh,

309
00:13:17.835 --> 00:13:19.515
<00:13:17.835>actions <00:13:18.185>you <00:13:18.535>can <00:13:18.885>take, <00:13:19.235>uh,

310
00:13:19.535 --> 00:13:21.995
<00:13:19.535>and <00:13:19.768>also <00:13:20.001>just <00:13:20.235>about <00:13:20.468>general <00:13:20.701>development <00:13:20.935>practices.

311
00:13:22.215 --> 00:13:24.795
<00:13:22.215>What's <00:13:22.370>really <00:13:22.526>nice <00:13:22.681>about <00:13:22.837>this <00:13:22.992>is <00:13:23.148>it's <00:13:23.303>a <00:13:23.459>really <00:13:23.615>good

312
00:13:24.945 --> 00:13:28.555
<00:13:24.945>education <00:13:25.100>tool <00:13:25.256>where <00:13:25.411>you <00:13:25.567>can <00:13:25.722>be <00:13:25.878>taught <00:13:26.033>about <00:13:26.189>concepts <00:13:26.345>within

313
00:13:28.815 --> 00:13:30.675
<00:13:28.815>the <00:13:29.095>context <00:13:29.375>of <00:13:29.655>your <00:13:29.935>code <00:13:30.215>base

314
00:13:30.675 --> 00:13:32.795
<00:13:30.675>that <00:13:30.954>you <00:13:31.234>understand <00:13:31.515>rather <00:13:31.795>than <00:13:32.074>kind

315
00:13:32.795 --> 00:13:33.955
<00:13:32.795>of <00:13:33.143>just <00:13:33.491>generic <00:13:33.839>learning.

316
00:13:33.985 --> 00:13:35.555
<00:13:33.985>It's <00:13:34.265>a, <00:13:34.545>it's <00:13:34.825>another <00:13:35.105>recipe <00:13:35.385>app,

317
00:13:35.555 --> 00:13:36.835
<00:13:35.555>it's <00:13:35.843>another <00:13:36.131>to-do <00:13:36.419>list, <00:13:36.707>right?

318
00:13:36.975 --> 00:13:38.875
<00:13:36.975>No, <00:13:37.255>this <00:13:37.535>is <00:13:37.815>my <00:13:38.095>actual <00:13:38.375>application.

319
00:13:39.155 --> 00:13:40.835
<00:13:39.155>I <00:13:39.329>can <00:13:39.505>still <00:13:39.680>learn <00:13:39.855>the <00:13:40.030>same <00:13:40.204>things <00:13:40.380>through <00:13:40.555>it.

320
00:13:41.255 --> 00:13:43.315
<00:13:41.255>You <00:13:41.488>can <00:13:41.721>also <00:13:41.955>provide <00:13:42.188>specific <00:13:42.421>block, <00:13:42.655>uh,

321
00:13:43.635 --> 00:13:45.435
<00:13:43.635>specific <00:13:44.101>context <00:13:44.568>to <00:13:45.035>copilot.

322
00:13:45.455 --> 00:13:48.035
<00:13:45.455>So <00:13:45.630>like <00:13:45.805>blocks <00:13:45.980>of <00:13:46.155>code <00:13:46.330>in <00:13:46.505>an <00:13:46.680>individual <00:13:46.855>file

323
00:13:48.335 --> 00:13:51.435
<00:13:48.335>or <00:13:48.490>individual <00:13:48.646>files, <00:13:48.801>directory, <00:13:48.957>sets <00:13:49.112>of <00:13:49.268>files <00:13:49.423>and <00:13:49.579>so <00:13:49.735>on.

324
00:13:51.855 --> 00:13:55.075
<00:13:51.855>Um, <00:13:52.010>in <00:13:52.166>order <00:13:52.321>to <00:13:52.477>ask <00:13:52.632>it <00:13:52.788>questions <00:13:52.943>about <00:13:53.099>just <00:13:53.255>segments

325
00:13:55.205 --> 00:13:56.435
<00:13:55.205>right <00:13:55.481>of <00:13:55.758>your <00:13:56.035>code <00:13:56.311>base.

326
00:13:56.435 --> 00:13:58.115
<00:13:56.435>So <00:13:56.635>really, <00:13:56.834>really <00:13:57.035>nice. <00:13:57.234>Wanna <00:13:57.435>point <00:13:57.635>this <00:13:57.834>out,

327
00:13:58.145 --> 00:14:00.235
<00:13:58.145>this <00:13:58.345>is <00:13:58.545>a <00:13:58.745>really, <00:13:58.944>really <00:13:59.145>good <00:13:59.345>education <00:13:59.545>tool.

328
00:14:00.385 --> 00:14:04.555
<00:14:00.385>This <00:14:00.540>I <00:14:00.696>genuinely <00:14:00.851>use <00:14:01.007>in <00:14:01.162>order <00:14:01.318>to <00:14:01.473>learn <00:14:01.629>new <00:14:01.785>concepts.

329
00:14:05.395 --> 00:14:08.005
<00:14:05.395>Copilot <00:14:05.628>also <00:14:05.861>generates <00:14:06.095>code <00:14:06.328>in <00:14:06.561>a <00:14:06.795>number

330
00:14:08.065 --> 00:14:09.245
<00:14:08.065>of <00:14:08.596>different <00:14:09.127>contexts.

331
00:14:09.245 --> 00:14:10.725
<00:14:09.245>So <00:14:09.511>whether <00:14:09.777>that's <00:14:10.044>in <00:14:10.310>your <00:14:10.577>IDE

332
00:14:10.905 --> 00:14:13.765
<00:14:10.905>or <00:14:11.105>using <00:14:11.305>the <00:14:11.505>new <00:14:11.704>GitHub <00:14:11.905>copilot <00:14:12.105>coding <00:14:12.305>agent.

333
00:14:14.145 --> 00:14:15.605
<00:14:14.145>Now <00:14:14.473>this <00:14:14.802>is <00:14:15.130>the <00:14:15.459>lifecycle

334
00:14:15.905 --> 00:14:18.165
<00:14:15.905>of <00:14:16.185>a <00:14:16.464>GitHub <00:14:16.745>copilot <00:14:17.025>code <00:14:17.305>suggestion.

335
00:14:18.545 --> 00:14:20.405
<00:14:18.545>Now, <00:14:18.719>we're <00:14:18.895>not <00:14:19.069>gonna <00:14:19.245>run <00:14:19.420>through <00:14:19.594>all <00:14:19.770>of <00:14:19.944>this.

336
00:14:20.405 --> 00:14:23.645
<00:14:20.405>The <00:14:20.532>reason <00:14:20.659>I'm <00:14:20.786>showing <00:14:20.914>this <00:14:21.041>to <00:14:21.168>you <00:14:21.295>is <00:14:21.423>step <00:14:21.550>five <00:14:21.677>down <00:14:21.805>here

337
00:14:23.935 --> 00:14:27.645
<00:14:23.935>where <00:14:24.109>some <00:14:24.285>LLM <00:14:24.459>some <00:14:24.635>model <00:14:24.810>has <00:14:24.984>returned <00:14:25.160>some <00:14:25.334>information,

338
00:14:27.905 --> 00:14:29.725
<00:14:27.905>but <00:14:28.079>it <00:14:28.255>hasn't <00:14:28.430>yet <00:14:28.605>made <00:14:28.780>its <00:14:28.954>way <00:14:29.130>to <00:14:29.305>you.

339
00:14:30.065 --> 00:14:33.605
<00:14:30.065>And <00:14:30.192>during <00:14:30.319>this <00:14:30.446>step, <00:14:30.574>we <00:14:30.701>are, <00:14:30.828>uh, <00:14:30.955>we <00:14:31.083>are <00:14:31.210>assessing <00:14:31.337>the <00:14:31.465>code

340
00:14:33.605 --> 00:14:35.805
<00:14:33.605>that <00:14:33.838>is <00:14:34.071>being <00:14:34.305>returned <00:14:34.538>for <00:14:34.771>obvious <00:14:35.005>vulnerabilities

341
00:14:35.825 --> 00:14:37.085
<00:14:35.825>before <00:14:36.051>it <00:14:36.278>ever <00:14:36.505>comes <00:14:36.732>to <00:14:36.959>you,

342
00:14:37.225 --> 00:14:39.725
<00:14:37.225>and <00:14:37.365>then <00:14:37.505>not <00:14:37.645>returning <00:14:37.785>it <00:14:37.925>to <00:14:38.065>you <00:14:38.205>if <00:14:38.345>there's <00:14:38.485>a <00:14:38.625>problem.

343
00:14:40.265 --> 00:14:43.005
<00:14:40.265>Now, <00:14:40.420>of <00:14:40.576>course, <00:14:40.731>you <00:14:40.887>should <00:14:41.042>still <00:14:41.198>always <00:14:41.353>validate <00:14:41.509>the <00:14:41.665>output

344
00:14:43.265 --> 00:14:44.525
<00:14:43.265>of <00:14:43.643>large <00:14:44.021>language <00:14:44.399>models

345
00:14:44.585 --> 00:14:46.725
<00:14:44.585>before <00:14:44.785>taking <00:14:44.985>that <00:14:45.185>code <00:14:45.385>and <00:14:45.585>running <00:14:45.785>with <00:14:45.985>it.

346
00:14:46.905 --> 00:14:51.045
<00:14:46.905>But <00:14:47.045>we're <00:14:47.185>trying <00:14:47.324>to <00:14:47.464>help <00:14:47.605>you, <00:14:47.745>uh, <00:14:47.885>not <00:14:48.025>generate <00:14:48.165>and <00:14:48.305>create

347
00:14:51.305 --> 00:14:52.845
<00:14:51.305>and <00:14:51.766>publish <00:14:52.229>and <00:14:52.691>push

348
00:14:52.905 --> 00:14:55.445
<00:14:52.905>to <00:14:53.138>production <00:14:53.371>vulnerable <00:14:53.605>code <00:14:53.838>right <00:14:54.071>at <00:14:54.305>the

349
00:14:55.445 --> 00:14:56.685
<00:14:55.445>point <00:14:56.003>of <00:14:56.560>generation.

350
00:14:57.835 --> 00:15:00.455
<00:14:57.835>You <00:14:57.975>can <00:14:58.115>also <00:14:58.255>request <00:14:58.395>a <00:14:58.535>code <00:14:58.675>review <00:14:58.815>in <00:14:58.955>your <00:14:59.095>code <00:14:59.235>editor

351
00:15:00.475 --> 00:15:02.055
<00:15:00.475>before <00:15:00.825>ever <00:15:01.175>committing <00:15:01.525>your <00:15:01.875>code.

352
00:15:02.475 --> 00:15:04.695
<00:15:02.475>So <00:15:02.755>copilot <00:15:03.035>will <00:15:03.315>make <00:15:03.595>comments, <00:15:03.875>uh,

353
00:15:04.695 --> 00:15:06.455
<00:15:04.695>and <00:15:04.928>you <00:15:05.161>have <00:15:05.395>these <00:15:05.628>one <00:15:05.861>click <00:15:06.095>applies.

354
00:15:06.875 --> 00:15:08.775
<00:15:06.875>And <00:15:07.075>this <00:15:07.275>will <00:15:07.475>also <00:15:07.675>pick <00:15:07.875>up <00:15:08.075>on <00:15:08.275>potential

355
00:15:09.495 --> 00:15:11.335
<00:15:09.495>security <00:15:09.845>vulnerabilities <00:15:10.195>within <00:15:10.545>your <00:15:10.895>code.

356
00:15:11.835 --> 00:15:14.415
<00:15:11.835>Uh, <00:15:12.068>really <00:15:12.301>nice. <00:15:12.535>Now <00:15:12.768>in <00:15:13.001>github.com, <00:15:13.235>uh,

357
00:15:14.415 --> 00:15:17.135
<00:15:14.415>very <00:15:14.570>much <00:15:14.726>the <00:15:14.881>same <00:15:15.037>way <00:15:15.192>you <00:15:15.348>can <00:15:15.503>assign <00:15:15.659>copilot <00:15:15.814>like

358
00:15:17.135 --> 00:15:18.215
<00:15:17.135>you <00:15:17.378>would <00:15:17.621>any <00:15:17.864>other <00:15:18.107>person.

359
00:15:18.555 --> 00:15:20.375
<00:15:18.555>It <00:15:18.710>will <00:15:18.866>do <00:15:19.021>the <00:15:19.177>same <00:15:19.332>thing <00:15:19.488>within <00:15:19.643>a <00:15:19.799>few <00:15:19.954>minutes.

360
00:15:20.675 --> 00:15:22.935
<00:15:20.675>It <00:15:20.802>will <00:15:20.929>go <00:15:21.056>to <00:15:21.184>your, <00:15:21.311>it <00:15:21.438>will <00:15:21.565>go <00:15:21.693>to <00:15:21.820>your <00:15:21.947>pool <00:15:22.074>request.

361
00:15:23.075 --> 00:15:25.175
<00:15:23.075>It <00:15:23.250>will <00:15:23.425>leave <00:15:23.600>comments, <00:15:23.775>which <00:15:23.950>you <00:15:24.125>can <00:15:24.300>then <00:15:24.475>commit

362
00:15:25.175 --> 00:15:27.375
<00:15:25.175>or <00:15:25.375>add <00:15:25.574>to <00:15:25.775>a <00:15:25.974>batch <00:15:26.175>or <00:15:26.375>further <00:15:26.574>review.

363
00:15:27.755 --> 00:15:30.495
<00:15:27.755>So <00:15:27.930>we <00:15:28.105>also <00:15:28.280>have <00:15:28.455>these <00:15:28.630>AI <00:15:28.805>powered <00:15:28.980>tools, <00:15:29.155>uh,

364
00:15:30.555 --> 00:15:32.375
<00:15:30.555>to <00:15:30.755>review <00:15:30.954>the <00:15:31.155>code <00:15:31.354>that <00:15:31.555>you <00:15:31.755>are <00:15:31.954>writing.

365
00:15:32.795 --> 00:15:35.295
<00:15:32.795>Now <00:15:32.935>in <00:15:33.074>the <00:15:33.214>IDE, <00:15:33.354>you <00:15:33.495>don't <00:15:33.635>even <00:15:33.775>need <00:15:33.915>to <00:15:34.055>be <00:15:34.194>committing

366
00:15:35.435 --> 00:15:37.935
<00:15:35.435>or <00:15:35.590>pushing <00:15:35.746>your <00:15:35.901>code <00:15:36.057>in <00:15:36.212>order <00:15:36.368>to <00:15:36.523>use <00:15:36.679>code <00:15:36.834>review.

367
00:15:38.085 --> 00:15:40.095
<00:15:38.085>This <00:15:38.285>is <00:15:38.485>actually <00:15:38.685>something <00:15:38.885>I've <00:15:39.085>just <00:15:39.285>started <00:15:39.485>doing

368
00:15:40.115 --> 00:15:42.455
<00:15:40.115>as <00:15:40.270>a <00:15:40.426>point <00:15:40.581>of <00:15:40.737>principle <00:15:40.892>before <00:15:41.048>I <00:15:41.203>hit <00:15:41.359>commit, <00:15:41.515>right?

369
00:15:42.455 --> 00:15:44.455
<00:15:42.455>I <00:15:42.562>want <00:15:42.670>the <00:15:42.778>code <00:15:42.885>and <00:15:42.993>a <00:15:43.101>commit <00:15:43.208>to <00:15:43.316>be <00:15:43.424>the <00:15:43.531>best <00:15:43.639>it <00:15:43.747>can <00:15:43.855>be.

370
00:15:44.755 --> 00:15:47.575
<00:15:44.755>So <00:15:44.882>I <00:15:45.009>hit, <00:15:45.136>you <00:15:45.264>know, <00:15:45.391>the <00:15:45.518>quick <00:15:45.645>little <00:15:45.773>code <00:15:45.900>review <00:15:46.027>in <00:15:46.155>my,

371
00:15:47.675 --> 00:15:50.575
<00:15:47.675>in <00:15:47.830>my <00:15:47.986>code <00:15:48.141>editor, <00:15:48.297>uh, <00:15:48.452>before <00:15:48.608>I <00:15:48.763>ever <00:15:48.919>hit <00:15:49.074>commit.

372
00:15:51.075 --> 00:15:55.415
<00:15:51.075>Now <00:15:51.202>we <00:15:51.329>have <00:15:51.456>used, <00:15:51.584>uh, <00:15:51.711>this <00:15:51.838>copilot <00:15:51.965>coding <00:15:52.093>agent <00:15:52.220>in <00:15:52.347>a <00:15:52.475>ton

373
00:15:55.435 --> 00:15:57.415
<00:15:55.435>of <00:15:55.785>internal <00:15:56.135>repositories <00:15:56.484>at <00:15:56.834>GitHub.

374
00:15:57.595 --> 00:15:59.015
<00:15:57.595>It <00:15:58.021>works <00:15:58.447>remarkably <00:15:58.873>well.

375
00:15:59.355 --> 00:16:01.775
<00:15:59.355>Um, <00:15:59.510>not <00:15:59.666>all <00:15:59.821>the <00:15:59.977>time <00:16:00.132>does <00:16:00.288>it <00:16:00.443>return <00:16:00.599>anything <00:16:00.755>useful,

376
00:16:01.775 --> 00:16:04.055
<00:16:01.775>but <00:16:01.915>when <00:16:02.055>it <00:16:02.194>does, <00:16:02.334>we're <00:16:02.475>thankful <00:16:02.615>to <00:16:02.755>have <00:16:02.895>it <00:16:03.035>in <00:16:03.175>place.

377
00:16:04.515 --> 00:16:07.295
<00:16:04.515>Now, <00:16:04.655>all <00:16:04.795>of <00:16:04.935>those <00:16:05.074>pull <00:16:05.215>requests <00:16:05.355>still <00:16:05.495>have <00:16:05.635>a <00:16:05.775>human <00:16:05.915>reviewer.

378
00:16:07.295 --> 00:16:10.495
<00:16:07.295>That's <00:16:07.450>something <00:16:07.606>we <00:16:07.761>still <00:16:07.917>very, <00:16:08.072>very <00:16:08.228>much <00:16:08.383>think <00:16:08.539>is, <00:16:08.694>um,

379
00:16:11.235 --> 00:16:12.295
<00:16:11.235>is <00:16:11.712>very <00:16:12.189>important.

380
00:16:12.595 --> 00:16:17.175
<00:16:12.595>But <00:16:12.750>this <00:16:12.906>allows <00:16:13.061>one <00:16:13.217>a <00:16:13.372>very <00:16:13.528>rapid <00:16:13.683>first <00:16:13.839>pass, <00:16:13.995>right?

381
00:16:17.175 --> 00:16:20.015
<00:16:17.175>That <00:16:17.330>allows <00:16:17.486>us <00:16:17.641>to <00:16:17.797>catch <00:16:17.952>silly <00:16:18.108>little <00:16:18.263>things <00:16:18.419>that <00:16:18.574>sometimes

382
00:16:20.555 --> 00:16:23.495
<00:16:20.555>we <00:16:20.729>miss <00:16:20.905>before <00:16:21.079>pushing <00:16:21.255>code <00:16:21.430>and <00:16:21.604>opening <00:16:21.780>pull <00:16:21.954>requests.

383
00:16:23.635 --> 00:16:26.295
<00:16:23.635>But <00:16:23.762>it <00:16:23.889>also <00:16:24.016>means <00:16:24.144>that <00:16:24.271>by <00:16:24.398>the <00:16:24.525>time <00:16:24.653>a <00:16:24.780>person <00:16:24.907>comes <00:16:25.035>around

384
00:16:26.295 --> 00:16:28.855
<00:16:26.295>to <00:16:26.528>it, <00:16:26.761>they're <00:16:26.995>focusing <00:16:27.228>on <00:16:27.461>more <00:16:27.694>impactful

385
00:16:29.035 --> 00:16:32.775
<00:16:29.035>or <00:16:29.314>strategic <00:16:29.594>feedback, <00:16:29.875>rather <00:16:30.155>than, <00:16:30.435>oh,

386
00:16:32.955 --> 00:16:34.575
<00:16:32.955>in <00:16:33.155>this <00:16:33.355>case <00:16:33.555>this <00:16:33.755>isn't <00:16:33.955>a <00:16:34.155>security <00:16:34.355>problem,

387
00:16:34.595 --> 00:16:36.255
<00:16:34.595>but <00:16:34.828>ah, <00:16:35.061>you <00:16:35.295>missed <00:16:35.528>an <00:16:35.761>async <00:16:35.995>keyword.

388
00:16:36.275 --> 00:16:39.815
<00:16:36.275>And <00:16:36.402>later <00:16:36.529>on <00:16:36.656>in <00:16:36.784>this <00:16:36.911>pull <00:16:37.038>request, <00:16:37.165>I <00:16:37.293>remember <00:16:37.420>my, <00:16:37.547>uh, <00:16:37.675>my

389
00:16:40.425 --> 00:16:42.775
<00:16:40.425>route <00:16:40.658>handler <00:16:40.891>definitions <00:16:41.125>in <00:16:41.358>my <00:16:41.591>express <00:16:41.824>app

390
00:16:42.775 --> 00:16:44.015
<00:16:42.775>with <00:16:42.961>the <00:16:43.146>wrong <00:16:43.333>way <00:16:43.519>around, <00:16:43.705>and <00:16:43.891>one

391
00:16:44.015 --> 00:16:45.735
<00:16:44.015>of <00:16:44.248>them <00:16:44.481>would <00:16:44.715>never <00:16:44.948>be <00:16:45.181>hit, <00:16:45.415>right?

392
00:16:45.745 --> 00:16:47.095
<00:16:45.745>These <00:16:46.048>are <00:16:46.352>silly <00:16:46.656>little <00:16:46.960>things,

393
00:16:47.435 --> 00:16:50.175
<00:16:47.435>but <00:16:47.635>in <00:16:47.834>terms <00:16:48.035>of <00:16:48.234>talking <00:16:48.435>about <00:16:48.635>bigger <00:16:48.834>architectural

394
00:16:50.415 --> 00:16:52.735
<00:16:50.415>decisions, <00:16:50.570>that's <00:16:50.726>where <00:16:50.881>one <00:16:51.037>of <00:16:51.192>my <00:16:51.348>teammates <00:16:51.503>can <00:16:51.659>come <00:16:51.814>in

395
00:16:52.735 --> 00:16:54.015
<00:16:52.735>and <00:16:53.023>have <00:16:53.311>the <00:16:53.599>most <00:16:53.887>impact.

396
00:16:54.795 --> 00:16:56.895
<00:16:54.795>So <00:16:54.995>talk, <00:16:55.194>moving <00:16:55.395>into <00:16:55.594>talking <00:16:55.795>about <00:16:55.995>code <00:16:56.194>security,

397
00:16:57.135 --> 00:16:58.975
<00:16:57.135>I <00:16:57.368>also <00:16:57.601>wanna <00:16:57.835>talk <00:16:58.068>about <00:16:58.301>code <00:16:58.535>ql.

398
00:16:59.475 --> 00:17:03.255
<00:16:59.475>So <00:16:59.630>K <00:16:59.786>QL <00:16:59.941>is <00:17:00.097>our <00:17:00.252>industry <00:17:00.408>leading <00:17:00.563>code <00:17:00.719>analysis <00:17:00.875>engine

399
00:17:03.365 --> 00:17:06.495
<00:17:03.365>that <00:17:03.565>helps <00:17:03.765>find <00:17:03.965>potential <00:17:04.165>vulnerabilities <00:17:04.365>in <00:17:04.565>code <00:17:04.765>bases.

400
00:17:06.755 --> 00:17:09.215
<00:17:06.755>And <00:17:06.930>what's <00:17:07.105>really <00:17:07.280>powerful <00:17:07.455>about <00:17:07.630>this <00:17:07.805>is <00:17:07.980>something <00:17:08.155>called

401
00:17:09.215 --> 00:17:10.575
<00:17:09.214>variant <00:17:10.439>analysis.

402
00:17:10.835 --> 00:17:13.735
<00:17:10.835>So <00:17:10.990>this <00:17:11.146>is <00:17:11.301>the <00:17:11.457>process <00:17:11.612>of <00:17:11.768>using <00:17:11.923>a <00:17:12.079>known <00:17:12.235>security

403
00:17:13.735 --> 00:17:15.375
<00:17:13.734>vulnerability <00:17:14.201>as <00:17:14.668>a <00:17:15.135>seed

404
00:17:15.635 --> 00:17:18.255
<00:17:15.635>to <00:17:15.835>find <00:17:16.035>other <00:17:16.234>similar <00:17:16.435>patterns <00:17:16.635>in <00:17:16.835>your <00:17:17.035>code

405
00:17:18.255 --> 00:17:19.655
<00:17:18.255>that <00:17:18.507>will <00:17:18.759>achieve <00:17:19.011>the <00:17:19.262>same <00:17:19.514>thing.

406
00:17:19.885 --> 00:17:22.855
<00:17:19.885>This <00:17:20.040>is <00:17:20.196>a <00:17:20.351>pattern <00:17:20.507>used <00:17:20.662>by <00:17:20.818>security <00:17:20.973>researchers <00:17:21.129>in <00:17:21.285>order

407
00:17:22.855 --> 00:17:26.375
<00:17:22.855>to <00:17:23.010>identify <00:17:23.166>security <00:17:23.321>vulnerabilities <00:17:23.477>and <00:17:23.632>is <00:17:23.788>part <00:17:23.943>of <00:17:24.099>code <00:17:24.255>ql

408
00:17:26.915 --> 00:17:30.375
<00:17:26.915>and <00:17:27.055>code <00:17:27.194>QL <00:17:27.335>powers <00:17:27.474>a <00:17:27.615>lot <00:17:27.754>of <00:17:27.895>the <00:17:28.034>GitHub <00:17:28.175>security <00:17:28.315>features.

409
00:17:30.675 --> 00:17:33.695
<00:17:30.675>And <00:17:30.815>one <00:17:30.955>of <00:17:31.095>the <00:17:31.235>ways <00:17:31.375>which <00:17:31.514>this <00:17:31.655>manifests <00:17:31.794>is <00:17:31.935>within <00:17:32.075>code

410
00:17:33.935 --> 00:17:36.295
<00:17:33.935>scanning <00:17:34.135>checks, <00:17:34.335>which <00:17:34.534>you <00:17:34.735>can <00:17:34.935>enable <00:17:35.135>in <00:17:35.335>some

411
00:17:36.435 --> 00:17:39.415
<00:17:36.435>or <00:17:36.668>all <00:17:36.901>pool <00:17:37.135>requests <00:17:37.368>within <00:17:37.601>your <00:17:37.835>repositories.

412
00:17:39.905 --> 00:17:41.895
<00:17:39.905>Again, <00:17:40.138>what's <00:17:40.371>really <00:17:40.605>nice <00:17:40.838>about <00:17:41.071>this, <00:17:41.305>what's,

413
00:17:41.895 --> 00:17:44.535
<00:17:41.895>what <00:17:42.035>is <00:17:42.175>stopping <00:17:42.315>this <00:17:42.455>being <00:17:42.595>an <00:17:42.735>additional <00:17:42.875>tool <00:17:43.014>that <00:17:43.155>you <00:17:43.295>need

414
00:17:44.535 --> 00:17:46.935
<00:17:44.535>to <00:17:44.710>pick <00:17:44.885>up <00:17:45.060>and <00:17:45.235>learn <00:17:45.410>is <00:17:45.585>developers <00:17:45.760>are <00:17:45.935>used

415
00:17:46.935 --> 00:17:49.620
<00:17:46.935>to <00:17:47.090>seeing <00:17:47.246>these <00:17:47.401>checks <00:17:47.557>inside <00:17:47.712>of <00:17:47.868>a <00:17:48.023>a <00:17:48.179>pool <00:17:48.335>request.

416
00:17:50.065 --> 00:17:52.485
<00:17:50.065>We, <00:17:50.265>we <00:17:50.465>are <00:17:50.665>used <00:17:50.865>to <00:17:51.065>seeing <00:17:51.265>checks <00:17:51.465>inside

417
00:17:52.485 --> 00:17:53.885
<00:17:52.485>of <00:17:52.800>this <00:17:53.115>pool <00:17:53.430>request, <00:17:53.745>uh,

418
00:17:53.905 --> 00:17:55.485
<00:17:53.905>and <00:17:54.138>making <00:17:54.371>sure <00:17:54.605>that <00:17:54.838>they <00:17:55.071>all <00:17:55.305>have

419
00:17:55.485 --> 00:17:56.565
<00:17:55.485>a <00:17:55.679>green <00:17:55.873>check <00:17:56.068>next <00:17:56.262>to <00:17:56.457>them.

420
00:17:56.825 --> 00:17:58.565
<00:17:56.825>So <00:17:57.105>it's <00:17:57.385>within <00:17:57.665>that <00:17:57.945>existing <00:17:58.225>workflow.

421
00:17:58.565 --> 00:18:01.365
<00:17:58.565>But <00:17:58.765>now <00:17:58.965>we're <00:17:59.165>also <00:17:59.365>checking <00:17:59.565>for <00:17:59.765>security <00:17:59.965>vulnerabilities

422
00:18:01.465 --> 00:18:05.565
<00:18:01.465>and <00:18:01.665>the <00:18:01.865>code <00:18:02.064>that <00:18:02.264>we <00:18:02.465>are <00:18:02.665>producing, <00:18:02.865>89%

423
00:18:05.565 --> 00:18:08.445
<00:18:05.565>of <00:18:05.740>the <00:18:05.915>vulnerabilities <00:18:06.090>I <00:18:06.265>showed <00:18:06.440>you <00:18:06.615>earlier <00:18:06.790>when <00:18:06.965>nine,

424
00:18:08.445 --> 00:18:12.685
<00:18:08.445>where <00:18:08.600>something <00:18:08.756>like <00:18:08.911>94% <00:18:09.067>of <00:18:09.222>of <00:18:09.378>projects <00:18:09.533>had <00:18:09.689>a <00:18:09.845>vulnerability

425
00:18:12.915 --> 00:18:16.325
<00:18:12.915>that <00:18:13.090>was <00:18:13.264>in <00:18:13.440>first <00:18:13.615>party <00:18:13.790>code, <00:18:13.965>not <00:18:14.139>independencies, <00:18:14.315>right?

426
00:18:16.325 --> 00:18:20.165
<00:18:16.325>That <00:18:16.525>was <00:18:16.725>code <00:18:16.925>that <00:18:17.125>we <00:18:17.325>produced, <00:18:17.525>uh, <00:18:17.725>manifested,

427
00:18:20.235 --> 00:18:21.325
<00:18:20.235>vibe <00:18:20.725>coded <00:18:21.216>whatever,

428
00:18:21.425 --> 00:18:23.245
<00:18:21.425>but <00:18:21.705>they, <00:18:21.985>it <00:18:22.264>was <00:18:22.544>our <00:18:22.825>responsibility

429
00:18:23.245 --> 00:18:24.605
<00:18:23.245>to <00:18:23.489>make <00:18:23.734>sure <00:18:23.979>that <00:18:24.224>was <00:18:24.469>secure.

430
00:18:24.865 --> 00:18:26.365
<00:18:24.865>And <00:18:25.015>this <00:18:25.165>is <00:18:25.315>a <00:18:25.465>way <00:18:25.615>that <00:18:25.765>we're <00:18:25.915>trying <00:18:26.065>to <00:18:26.215>help

431
00:18:26.365 --> 00:18:28.445
<00:18:26.365>that <00:18:26.598>happen <00:18:26.831>within <00:18:27.065>the <00:18:27.298>pool <00:18:27.531>request <00:18:27.765>flow.

432
00:18:29.495 --> 00:18:32.195
<00:18:29.495>So <00:18:29.622>when <00:18:29.749>it <00:18:29.876>comes <00:18:30.004>to <00:18:30.131>code <00:18:30.258>security <00:18:30.385>within <00:18:30.513>your <00:18:30.640>own <00:18:30.767>code <00:18:30.895>base

433
00:18:32.295 --> 00:18:35.075
<00:18:32.295>and <00:18:32.575>identifying <00:18:32.855>vulnerabilities <00:18:33.135>as <00:18:33.415>mentioned <00:18:33.695>earlier,

434
00:18:35.275 --> 00:18:38.755
<00:18:35.275>alerting <00:18:35.450>or <00:18:35.625>just <00:18:35.800>failing <00:18:35.975>out <00:18:36.150>is <00:18:36.325>certainly <00:18:36.500>one <00:18:36.675>step,

435
00:18:38.935 --> 00:18:41.675
<00:18:38.935>but <00:18:39.110>it <00:18:39.284>isn't <00:18:39.460>actually <00:18:39.635>what <00:18:39.810>we <00:18:39.985>need <00:18:40.159>to <00:18:40.335>happen.

436
00:18:41.705 --> 00:18:44.915
<00:18:41.705>What <00:18:41.860>we <00:18:42.016>need <00:18:42.171>to <00:18:42.327>happen <00:18:42.482>is <00:18:42.638>those <00:18:42.793>security <00:18:42.949>vulnerabilities <00:18:43.105>are

437
00:18:45.065 --> 00:18:47.795
<00:18:45.065>removed <00:18:45.265>and <00:18:45.465>our <00:18:45.665>security <00:18:45.865>debt <00:18:46.065>is <00:18:46.265>burned <00:18:46.465>down.

438
00:18:48.095 --> 00:18:51.115
<00:18:48.095>And <00:18:48.250>this <00:18:48.406>is <00:18:48.561>where <00:18:48.717>GitHub <00:18:48.872>co-pilot, <00:18:49.028>auto <00:18:49.183>Fixx <00:18:49.339>comes <00:18:49.495>in.

439
00:18:51.335 --> 00:18:55.475
<00:18:51.335>So <00:18:51.475>what <00:18:51.615>this <00:18:51.755>will <00:18:51.895>do <00:18:52.035>is <00:18:52.175>automatically <00:18:52.315>produce <00:18:52.455>fixes <00:18:52.595>for, <00:18:52.735>uh,

440
00:18:55.935 --> 00:18:57.395
<00:18:55.935>failed <00:18:56.373>code <00:18:56.811>QL <00:18:57.249>checks.

441
00:18:57.745 --> 00:18:59.675
<00:18:57.745>It's <00:18:57.919>super, <00:18:58.094>super <00:18:58.270>nice. <00:18:58.445>Let's <00:18:58.620>see <00:18:58.794>how <00:18:58.969>it <00:18:59.145>works.

442
00:18:59.675 --> 00:19:01.155
<00:18:59.675>So <00:19:00.008>here <00:19:00.341>in <00:19:00.674>pool <00:19:01.007>requests,

443
00:19:01.555 --> 00:19:03.435
<00:19:01.555>co-pilot <00:19:01.835>auto <00:19:02.115>fixx <00:19:02.395>will <00:19:02.675>add <00:19:02.955>comments.

444
00:19:03.615 --> 00:19:06.635
<00:19:03.615>It <00:19:03.790>will <00:19:03.965>explain <00:19:04.140>what <00:19:04.315>has <00:19:04.490>gone <00:19:04.665>wrong <00:19:04.840>here <00:19:05.015>along

445
00:19:06.635 --> 00:19:07.795
<00:19:06.635>with <00:19:06.983>a <00:19:07.331>suggested <00:19:07.679>fix.

446
00:19:08.195 --> 00:19:11.075
<00:19:08.195>I <00:19:08.322>can <00:19:08.449>go <00:19:08.576>ahead <00:19:08.704>and <00:19:08.831>commit <00:19:08.958>that <00:19:09.085>change, <00:19:09.213>uh, <00:19:09.340>in <00:19:09.467>one <00:19:09.595>click

447
00:19:11.075 --> 00:19:12.475
<00:19:11.075>and <00:19:11.285>then <00:19:11.495>being <00:19:11.705>in <00:19:11.915>a <00:19:12.125>pool <00:19:12.335>request,

448
00:19:12.975 --> 00:19:15.315
<00:19:12.975>my <00:19:13.208>standard <00:19:13.441>GitHub <00:19:13.675>actions <00:19:13.908>workflows <00:19:14.141>are <00:19:14.375>run.

449
00:19:15.435 --> 00:19:17.155
<00:19:15.435>I <00:19:15.590>can <00:19:15.746>now <00:19:15.901>make <00:19:16.057>sure <00:19:16.212>all <00:19:16.368>of <00:19:16.523>these <00:19:16.679>are <00:19:16.835>checked

450
00:19:17.375 --> 00:19:18.555
<00:19:17.375>and <00:19:17.587>then <00:19:17.799>I <00:19:18.012>can <00:19:18.224>move <00:19:18.437>on.

451
00:19:19.295 --> 00:19:20.675
<00:19:19.295>Now <00:19:19.709>for <00:19:20.123>existing <00:19:20.537>code,

452
00:19:21.015 --> 00:19:23.715
<00:19:21.015>the <00:19:21.155>code <00:19:21.295>scanning <00:19:21.435>alerts <00:19:21.575>are <00:19:21.715>shown <00:19:21.855>in <00:19:21.995>the <00:19:22.135>security <00:19:22.275>tab <00:19:22.415>at

453
00:19:23.715 --> 00:19:24.835
<00:19:23.715>the <00:19:23.966>top <00:19:24.219>of <00:19:24.471>a <00:19:24.723>repository.

454
00:19:25.145 --> 00:19:27.755
<00:19:25.145>Once <00:19:25.300>again, <00:19:25.456>here <00:19:25.611>we <00:19:25.767>are <00:19:25.922>seeing <00:19:26.078>this <00:19:26.233>is <00:19:26.389>the <00:19:26.545>vulnerability.

455
00:19:28.415 --> 00:19:31.635
<00:19:28.415>Um, <00:19:28.570>this <00:19:28.726>is <00:19:28.881>where, <00:19:29.037>uh, <00:19:29.192>the <00:19:29.348>error <00:19:29.503>was <00:19:29.659>introduced, <00:19:29.815>when,

456
00:19:31.635 --> 00:19:33.395
<00:19:31.635>which <00:19:31.868>commit, <00:19:32.101>what <00:19:32.335>days, <00:19:32.568>stuff <00:19:32.801>like <00:19:33.035>that,

457
00:19:33.695 --> 00:19:35.355
<00:19:33.695>and <00:19:33.928>an <00:19:34.161>explanation <00:19:34.395>of <00:19:34.628>what's <00:19:34.861>gone <00:19:35.095>wrong.

458
00:19:35.455 --> 00:19:37.475
<00:19:35.455>And <00:19:35.610>in <00:19:35.766>one <00:19:35.921>click <00:19:36.077>I <00:19:36.232>can <00:19:36.388>produce <00:19:36.543>a <00:19:36.699>pull <00:19:36.855>request,

459
00:19:37.485 --> 00:19:39.915
<00:19:37.485>which <00:19:37.659>then <00:19:37.834>again, <00:19:38.010>will <00:19:38.185>go <00:19:38.360>through <00:19:38.534>that <00:19:38.709>standard <00:19:38.885>flow.

460
00:19:40.575 --> 00:19:42.755
<00:19:40.575>So <00:19:40.715>this <00:19:40.855>is <00:19:40.995>again, <00:19:41.135>a <00:19:41.275>really <00:19:41.415>nice <00:19:41.555>tool <00:19:41.695>to <00:19:41.835>burn <00:19:41.975>down

461
00:19:42.755 --> 00:19:43.995
<00:19:42.755>that <00:19:43.313>security <00:19:43.870>backlog.

462
00:19:44.555 --> 00:19:46.635
<00:19:44.555>I <00:19:44.682>also <00:19:44.809>think <00:19:44.936>it's <00:19:45.064>fair <00:19:45.191>to <00:19:45.318>just <00:19:45.445>pause <00:19:45.573>here <00:19:45.700>for <00:19:45.827>a <00:19:45.955>moment

463
00:19:46.695 --> 00:19:48.795
<00:19:46.695>and <00:19:46.928>be <00:19:47.161>like, <00:19:47.395>ai, <00:19:47.628>ai, <00:19:47.861>ai, <00:19:48.095>great.

464
00:19:49.375 --> 00:19:52.635
<00:19:49.375>If <00:19:49.575>your <00:19:49.775>organization <00:19:49.975>has <00:19:50.175>already <00:19:50.375>adopted <00:19:50.575>DevOps <00:19:50.775>practices,

465
00:19:52.635 --> 00:19:56.435
<00:19:52.635>that <00:19:52.790>is <00:19:52.946>writing <00:19:53.101>good <00:19:53.257>tests, <00:19:53.412>that <00:19:53.568>is <00:19:53.723>having, <00:19:53.879>uh, <00:19:54.035>having,

466
00:19:56.735 --> 00:19:59.035
<00:19:56.735>you <00:19:56.935>know, <00:19:57.135>co <00:19:57.334>checks <00:19:57.534>happening <00:19:57.735>on <00:19:57.935>your <00:19:58.135>code

467
00:19:59.075 --> 00:20:01.715
<00:19:59.075>before <00:19:59.202>you <00:19:59.329>are <00:19:59.456>merging <00:19:59.584>them <00:19:59.711>in, <00:19:59.838>you <00:19:59.965>are <00:20:00.093>in <00:20:00.220>the <00:20:00.347>best <00:20:00.475>position

468
00:20:02.135 --> 00:20:04.115
<00:20:02.135>to <00:20:02.368>now <00:20:02.601>also <00:20:02.835>adopt <00:20:03.068>these <00:20:03.301>AI <00:20:03.535>tools.

469
00:20:04.555 --> 00:20:07.035
<00:20:04.555>'cause <00:20:04.730>in <00:20:04.905>this <00:20:05.080>example <00:20:05.255>here, <00:20:05.430>AI <00:20:05.605>is <00:20:05.780>generating <00:20:05.955>code.

470
00:20:07.385 --> 00:20:09.435
<00:20:07.385>They're <00:20:07.585>being <00:20:07.785>opened <00:20:07.985>up <00:20:08.185>in <00:20:08.385>a <00:20:08.585>pool <00:20:08.785>request.

471
00:20:10.295 --> 00:20:11.715
<00:20:10.295>All <00:20:10.477>of <00:20:10.660>my <00:20:10.842>tests <00:20:11.025>still <00:20:11.207>need <00:20:11.390>to <00:20:11.572>pass.

472
00:20:11.935 --> 00:20:13.395
<00:20:11.935>So <00:20:12.099>this <00:20:12.263>is <00:20:12.427>just <00:20:12.591>something <00:20:12.756>to <00:20:12.920>bear <00:20:13.084>in <00:20:13.249>mind.

473
00:20:13.395 --> 00:20:15.675
<00:20:13.395>You're <00:20:13.522>in <00:20:13.649>the <00:20:13.776>best <00:20:13.904>position <00:20:14.031>if <00:20:14.158>you <00:20:14.285>have <00:20:14.413>a <00:20:14.540>strong <00:20:14.667>test <00:20:14.795>suite

474
00:20:15.675 --> 00:20:17.835
<00:20:15.675>and <00:20:15.875>practices <00:20:16.075>to <00:20:16.274>make <00:20:16.475>sure <00:20:16.675>that <00:20:16.875>they're <00:20:17.075>run

475
00:20:17.835 --> 00:20:20.715
<00:20:17.835>before <00:20:18.035>code <00:20:18.235>is <00:20:18.435>actually <00:20:18.635>making <00:20:18.835>it <00:20:19.035>into <00:20:19.235>production.

476
00:20:21.135 --> 00:20:23.595
<00:20:21.135>Now, <00:20:21.262>to <00:20:21.389>dig <00:20:21.516>into <00:20:21.644>what <00:20:21.771>we <00:20:21.898>saw <00:20:22.025>a <00:20:22.153>little <00:20:22.280>bit <00:20:22.407>more <00:20:22.535>here,

477
00:20:23.745 --> 00:20:26.395
<00:20:23.745>code <00:20:23.900>scanning <00:20:24.056>with <00:20:24.211>code <00:20:24.367>ql, <00:20:24.522>uh, <00:20:24.678>doesn't <00:20:24.833>just <00:20:24.989>happen <00:20:25.145>at

478
00:20:26.395 --> 00:20:27.435
<00:20:26.395>that <00:20:26.582>point <00:20:26.769>of <00:20:26.956>a <00:20:27.143>pull <00:20:27.331>request,

479
00:20:27.455 --> 00:20:30.435
<00:20:27.455>but <00:20:27.610>immediately <00:20:27.766>when <00:20:27.921>turned <00:20:28.077>on, <00:20:28.232>you <00:20:28.388>get <00:20:28.543>that <00:20:28.699>security <00:20:28.855>tab,

480
00:20:30.435 --> 00:20:31.675
<00:20:30.435>you <00:20:30.658>get <00:20:30.881>the <00:20:31.104>code <00:20:31.327>scanning <00:20:31.551>alerts,

481
00:20:31.675 --> 00:20:33.435
<00:20:31.675>and <00:20:31.830>this <00:20:31.986>is <00:20:32.141>what <00:20:32.297>we <00:20:32.452>saw <00:20:32.608>in <00:20:32.763>that <00:20:32.919>second <00:20:33.075>example.

482
00:20:34.215 --> 00:20:36.875
<00:20:34.215>Uh, <00:20:34.495>problems <00:20:34.774>are <00:20:35.054>identified, <00:20:35.334>they're <00:20:35.615>explained.

483
00:20:37.075 --> 00:20:38.675
<00:20:37.075>'cause <00:20:37.275>we <00:20:37.475>don't <00:20:37.675>just <00:20:37.875>wanna <00:20:38.075>be <00:20:38.275>fixing <00:20:38.475>problems,

484
00:20:38.675 --> 00:20:41.235
<00:20:38.675>we <00:20:38.815>wanna <00:20:38.955>be <00:20:39.095>helping <00:20:39.235>you <00:20:39.375>not <00:20:39.514>make <00:20:39.655>them <00:20:39.794>in <00:20:39.935>future, <00:20:40.075>right?

485
00:20:41.415 --> 00:20:43.275
<00:20:41.415>By <00:20:41.695>actually <00:20:41.975>teaching <00:20:42.254>you <00:20:42.534>better <00:20:42.815>practices.

486
00:20:43.495 --> 00:20:46.475
<00:20:43.495>And <00:20:43.635>actually, <00:20:43.774>I <00:20:43.915>enabled <00:20:44.054>this <00:20:44.195>in <00:20:44.334>one <00:20:44.475>of <00:20:44.614>my <00:20:44.754>own <00:20:44.895>projects

487
00:20:46.575 --> 00:20:49.565
<00:20:46.575>and <00:20:46.730>discovered <00:20:46.886>I <00:20:47.041>had <00:20:47.197>been <00:20:47.352>writing <00:20:47.508>an <00:20:47.663>insecure <00:20:47.819>code <00:20:47.975>pattern

488
00:20:49.965 --> 00:20:51.765
<00:20:49.965>probably <00:20:50.165>since <00:20:50.365>the <00:20:50.564>day <00:20:50.764>I <00:20:50.965>started <00:20:51.165>writing <00:20:51.365>code.

489
00:20:51.925 --> 00:20:55.165
<00:20:51.925>I <00:20:52.065>had <00:20:52.205>no <00:20:52.345>idea. <00:20:52.485>Uh, <00:20:52.625>now <00:20:52.764>I <00:20:52.905>do, <00:20:53.044>now <00:20:53.185>I <00:20:53.325>do.

490
00:20:55.385 --> 00:20:58.205
<00:20:55.385>And <00:20:55.560>then <00:20:55.735>copilot, <00:20:55.910>um, <00:20:56.085>copilot <00:20:56.260>allows <00:20:56.435>you <00:20:56.610>to <00:20:56.785>generate

491
00:20:58.205 --> 00:21:00.365
<00:20:58.205>that <00:20:58.360>fix <00:20:58.516>in <00:20:58.671>one <00:20:58.827>click <00:20:58.982>and <00:20:59.138>open <00:20:59.293>a <00:20:59.449>pull <00:20:59.605>request.

492
00:21:01.025 --> 00:21:02.045
<00:21:01.025>That's <00:21:01.484>code <00:21:01.943>security.

493
00:21:02.515 --> 00:21:04.605
<00:21:02.515>It's <00:21:02.795>about <00:21:03.075>helping <00:21:03.355>make <00:21:03.635>sure <00:21:03.915>code

494
00:21:04.605 --> 00:21:06.725
<00:21:04.605>that <00:21:04.805>you <00:21:05.005>write <00:21:05.205>is <00:21:05.405>more <00:21:05.605>secure <00:21:05.805>through <00:21:06.005>education

495
00:21:06.725 --> 00:21:09.725
<00:21:06.725>with <00:21:07.074>copilot <00:21:07.425>chat <00:21:07.774>processing, <00:21:08.125>um,

496
00:21:10.065 --> 00:21:13.485
<00:21:10.065>before <00:21:10.265>copilot <00:21:10.465>actually <00:21:10.665>returns, <00:21:10.865>uh, <00:21:11.065>results <00:21:11.265>to <00:21:11.465>you.

497
00:21:13.545 --> 00:21:14.805
<00:21:13.545>You <00:21:13.707>don't <00:21:13.869>need <00:21:14.031>to <00:21:14.193>do <00:21:14.355>anything <00:21:14.517>with <00:21:14.679>that.

498
00:21:14.805 --> 00:21:17.805
<00:21:14.805>That <00:21:14.945>just <00:21:15.085>happens <00:21:15.225>code <00:21:15.365>scanning <00:21:15.505>with <00:21:15.645>code <00:21:15.785>QL <00:21:15.925>at <00:21:16.065>the <00:21:16.205>point

499
00:21:17.805 --> 00:21:20.485
<00:21:17.805>of <00:21:17.945>a <00:21:18.085>pool <00:21:18.225>request, <00:21:18.365>and <00:21:18.505>then <00:21:18.645>copilot <00:21:18.785>auto <00:21:18.925>fixx <00:21:19.065>coming <00:21:19.205>in

500
00:21:20.485 --> 00:21:23.325
<00:21:20.485>clutch <00:21:20.764>to <00:21:21.044>actually, <00:21:21.324>uh, <00:21:21.604>actually <00:21:21.885>remediate

501
00:21:23.965 --> 00:21:25.765
<00:21:23.965>security <00:21:24.314>vulnerabilities <00:21:24.665>in <00:21:25.014>our <00:21:25.365>code.

502
00:21:26.185 --> 00:21:28.005
<00:21:26.185>But <00:21:26.534>when <00:21:26.885>we <00:21:27.235>ship <00:21:27.585>projects,

503
00:21:28.025 --> 00:21:30.445
<00:21:28.025>we <00:21:28.200>are <00:21:28.375>not <00:21:28.550>only <00:21:28.725>shipping <00:21:28.900>our <00:21:29.075>own <00:21:29.250>code, <00:21:29.425>right?

504
00:21:30.625 --> 00:21:33.645
<00:21:30.625>We <00:21:30.825>are <00:21:31.025>also <00:21:31.225>including <00:21:31.425>dependencies <00:21:31.625>in <00:21:31.825>whatever <00:21:32.025>language

505
00:21:33.715 --> 00:21:35.645
<00:21:33.715>ecosystem <00:21:34.064>we <00:21:34.415>are <00:21:34.764>using, <00:21:35.115>right?

506
00:21:35.645 --> 00:21:38.165
<00:21:35.645>They <00:21:35.925>could <00:21:36.205>be <00:21:36.485>dependencies, <00:21:36.764>packages, <00:21:37.045>libraries,

507
00:21:38.365 --> 00:21:39.605
<00:21:38.365>whatever <00:21:38.551>phrase <00:21:38.737>we <00:21:38.923>want <00:21:39.109>to <00:21:39.295>use <00:21:39.481>here.

508
00:21:39.825 --> 00:21:41.285
<00:21:39.825>And <00:21:40.087>they're <00:21:40.350>written <00:21:40.613>by <00:21:40.876>other <00:21:41.139>people.

509
00:21:42.315 --> 00:21:45.535
<00:21:42.315>The <00:21:42.595>GitHub <00:21:42.875>advisory <00:21:43.155>database <00:21:43.435>contains <00:21:43.715>CVEs

510
00:21:45.535 --> 00:21:48.375
<00:21:45.535>or <00:21:45.815>common <00:21:46.095>vulnerabilities <00:21:46.375>and <00:21:46.655>exposures, <00:21:46.935>um,

511
00:21:48.555 --> 00:21:51.135
<00:21:48.555>and <00:21:48.905>GitHub <00:21:49.255>originated <00:21:49.605>security, <00:21:49.955>uh,

512
00:21:51.135 --> 00:21:53.215
<00:21:51.135>advisories <00:21:51.415>affecting <00:21:51.695>the <00:21:51.975>open <00:21:52.254>source <00:21:52.535>world.

513
00:21:53.405 --> 00:21:55.415
<00:21:53.405>This <00:21:53.638>database <00:21:53.871>is <00:21:54.105>free, <00:21:54.338>it's <00:21:54.571>open <00:21:54.805>source.

514
00:21:55.715 --> 00:21:57.255
<00:21:55.715>And <00:21:55.913>again, <00:21:56.110>it <00:21:56.309>is <00:21:56.507>really <00:21:56.705>important <00:21:56.903>for <00:21:57.101>some

515
00:21:57.255 --> 00:21:59.015
<00:21:57.255>of <00:21:57.410>the <00:21:57.566>features <00:21:57.721>I'm <00:21:57.877>gonna <00:21:58.032>show <00:21:58.188>you <00:21:58.343>in <00:21:58.499>a <00:21:58.655>moment.

516
00:21:59.235 --> 00:22:02.455
<00:21:59.235>And <00:21:59.435>surfacing <00:21:59.635>these <00:21:59.834>vulnerabilities <00:22:00.034>in <00:22:00.235>a <00:22:00.435>standard <00:22:00.635>way,

517
00:22:02.695 --> 00:22:04.815
<00:22:02.695>regardless <00:22:02.928>of <00:22:03.161>whether <00:22:03.395>they <00:22:03.628>originated <00:22:03.861>from <00:22:04.095>GitHub,

518
00:22:04.995 --> 00:22:09.095
<00:22:04.995>the <00:22:05.228>National <00:22:05.461>Vulnerability <00:22:05.695>database, <00:22:05.928>NPM <00:22:06.161>Security, <00:22:06.395>um,

519
00:22:09.515 --> 00:22:11.295
<00:22:09.515>go <00:22:09.795>von <00:22:10.075>check <00:22:10.355>friends <00:22:10.635>of <00:22:10.915>PHP,

520
00:22:11.355 --> 00:22:14.775
<00:22:11.355>the <00:22:11.530>Python <00:22:11.705>Packaging <00:22:11.880>Advisory <00:22:12.055>Database <00:22:12.230>and, <00:22:12.405>and <00:22:12.580>more, <00:22:12.755>right?

521
00:22:14.775 --> 00:22:16.135
<00:22:14.775>So <00:22:14.949>these <00:22:15.124>are <00:22:15.299>all <00:22:15.474>brought <00:22:15.649>together <00:22:15.824>in <00:22:15.999>the

522
00:22:16.135 --> 00:22:17.855
<00:22:16.135>GitHub <00:22:16.835>advisory <00:22:17.535>database.

523
00:22:18.835 --> 00:22:20.495
<00:22:18.835>And <00:22:19.115>then <00:22:19.395>what <00:22:19.675>we <00:22:19.955>do, <00:22:20.235>um,

524
00:22:20.955 --> 00:22:22.375
<00:22:20.955>and <00:22:21.210>then <00:22:21.466>what <00:22:21.721>we <00:22:21.977>do <00:22:22.233>inside

525
00:22:22.375 --> 00:22:25.135
<00:22:22.375>of <00:22:22.515>your <00:22:22.655>pool <00:22:22.795>request <00:22:22.935>is <00:22:23.075>give <00:22:23.215>you <00:22:23.355>the <00:22:23.495>ability <00:22:23.635>to <00:22:23.775>use

526
00:22:25.135 --> 00:22:27.055
<00:22:25.135>what <00:22:25.368>is <00:22:25.601>known <00:22:25.835>as <00:22:26.068>a <00:22:26.301>dependency <00:22:26.535>review,

527
00:22:27.795 --> 00:22:28.975
<00:22:27.795>the <00:22:28.007>point <00:22:28.219>of <00:22:28.432>your <00:22:28.644>pool <00:22:28.857>request.

528
00:22:28.975 --> 00:22:30.615
<00:22:28.975>We'll <00:22:29.208>look <00:22:29.441>at <00:22:29.675>all <00:22:29.908>of <00:22:30.141>the <00:22:30.375>dependencies

529
00:22:30.845 --> 00:22:31.855
<00:22:30.845>that <00:22:31.148>you <00:22:31.451>have <00:22:31.754>included,

530
00:22:31.865 --> 00:22:35.015
<00:22:31.865>especially <00:22:32.020>this <00:22:32.176>is <00:22:32.331>important <00:22:32.487>when <00:22:32.642>you <00:22:32.798>are <00:22:32.953>including <00:22:33.109>a <00:22:33.265>new

531
00:22:35.015 --> 00:22:36.655
<00:22:35.015>dependency <00:22:35.715>or <00:22:36.415>upgrading

532
00:22:36.655 --> 00:22:38.935
<00:22:36.655>or <00:22:37.004>downgrading <00:22:37.355>an <00:22:37.705>existing <00:22:38.055>dependency.

533
00:22:39.275 --> 00:22:41.815
<00:22:39.275>Um, <00:22:39.450>and <00:22:39.625>this <00:22:39.800>will <00:22:39.975>help <00:22:40.150>you <00:22:40.325>understand <00:22:40.500>the <00:22:40.675>implications

534
00:22:41.835 --> 00:22:43.735
<00:22:41.835>of <00:22:42.068>those <00:22:42.301>changes <00:22:42.535>to <00:22:42.768>your <00:22:43.001>code <00:22:43.235>base.

535
00:22:43.995 --> 00:22:45.975
<00:22:43.995>So <00:22:44.150>this <00:22:44.306>will <00:22:44.461>help <00:22:44.617>you <00:22:44.772>both <00:22:44.928>in <00:22:45.083>terms <00:22:45.239>of <00:22:45.395>security

536
00:22:46.395 --> 00:22:48.255
<00:22:46.395>and <00:22:46.745>also <00:22:47.095>on <00:22:47.445>licensing <00:22:47.795>impact,

537
00:22:48.255 --> 00:22:50.535
<00:22:48.255>which <00:22:48.535>isn't <00:22:48.815>small <00:22:49.095>compliance <00:22:49.375>than <00:22:49.655>security,

538
00:22:50.875 --> 00:22:52.455
<00:22:50.875>but <00:22:51.030>I <00:22:51.186>wanna <00:22:51.341>kind <00:22:51.497>of <00:22:51.652>show <00:22:51.808>you <00:22:51.963>how <00:22:52.119>this <00:22:52.275>works.

539
00:22:52.555 --> 00:22:54.455
<00:22:52.555>So <00:22:52.788>this <00:22:53.021>is <00:22:53.255>the <00:22:53.488>whole <00:22:53.721>GitHub <00:22:53.955>action.

540
00:22:54.835 --> 00:22:57.695
<00:22:54.835>Uh, <00:22:54.990>down <00:22:55.146>here <00:22:55.301>is <00:22:55.457>the <00:22:55.612>important <00:22:55.768>part <00:22:55.923>Here <00:22:56.079>we <00:22:56.235>have

541
00:22:57.895 --> 00:22:59.735
<00:22:57.895>provided <00:22:58.175>a <00:22:58.455>fail <00:22:58.735>on <00:22:59.014>severity <00:22:59.295>value.

542
00:23:00.115 --> 00:23:02.775
<00:23:00.115>So <00:23:00.290>in <00:23:00.465>this <00:23:00.640>example, <00:23:00.815>we <00:23:00.990>are <00:23:01.165>allowing <00:23:01.340>low <00:23:01.515>risk

543
00:23:03.495 --> 00:23:05.895
<00:23:03.495>security <00:23:03.774>vulnerabilities <00:23:04.054>to <00:23:04.334>not <00:23:04.614>fail <00:23:04.895>my

544
00:23:06.015 --> 00:23:07.135
<00:23:06.015>CICD <00:23:06.519>pipeline, <00:23:07.023>right?

545
00:23:07.135 --> 00:23:09.415
<00:23:07.135>This <00:23:07.368>is <00:23:07.601>fine, <00:23:07.835>but <00:23:08.068>anything <00:23:08.301>moderate, <00:23:08.535>high

546
00:23:09.415 --> 00:23:11.335
<00:23:09.415>or <00:23:09.695>critical <00:23:09.975>that's <00:23:10.254>gonna <00:23:10.534>fail <00:23:10.815>out,

547
00:23:11.635 --> 00:23:13.295
<00:23:11.635>you <00:23:11.985>can <00:23:12.335>also <00:23:12.685>explicitly <00:23:13.035>allow

548
00:23:13.715 --> 00:23:16.735
<00:23:13.715>or <00:23:14.181>explicitly <00:23:14.648>disallow <00:23:15.115>licenses.

549
00:23:16.985 --> 00:23:18.735
<00:23:16.985>Again, <00:23:17.264>this <00:23:17.544>is <00:23:17.824>more <00:23:18.104>compliant, <00:23:18.385>but

550
00:23:18.735 --> 00:23:21.575
<00:23:18.735>because <00:23:18.890>it's <00:23:19.046>all <00:23:19.201>happening <00:23:19.357>within <00:23:19.512>the <00:23:19.668>same <00:23:19.823>action, <00:23:19.979>I <00:23:20.135>wanted

551
00:23:21.575 --> 00:23:25.295
<00:23:21.575>to <00:23:21.691>show <00:23:21.808>you <00:23:21.925>both <00:23:22.041>to <00:23:22.158>make <00:23:22.275>sure, <00:23:22.391>uh, <00:23:22.508>that <00:23:22.625>the <00:23:22.741>risk <00:23:22.858>of <00:23:22.975>pushing

552
00:23:25.865 --> 00:23:28.695
<00:23:25.865>vulnerable <00:23:26.215>or <00:23:26.565>rather <00:23:26.915>risky <00:23:27.265>dependencies

553
00:23:28.715 --> 00:23:30.415
<00:23:28.715>to <00:23:29.181>production <00:23:29.648>are <00:23:30.115>minimized.

554
00:23:31.165 --> 00:23:33.505
<00:23:31.165>And <00:23:31.340>this <00:23:31.514>is <00:23:31.690>great <00:23:31.865>if <00:23:32.040>a <00:23:32.215>dependency <00:23:32.389>is <00:23:32.565>known

555
00:23:33.745 --> 00:23:35.265
<00:23:33.745>to <00:23:34.018>be <00:23:34.292>vulnerable <00:23:34.565>at <00:23:34.839>the <00:23:35.113>point

556
00:23:35.265 --> 00:23:36.745
<00:23:35.265>of <00:23:35.531>including <00:23:35.797>it <00:23:36.064>in <00:23:36.330>your <00:23:36.597>project,

557
00:23:37.085 --> 00:23:38.785
<00:23:37.085>but <00:23:37.285>that <00:23:37.485>is <00:23:37.685>not <00:23:37.885>always <00:23:38.085>how <00:23:38.285>life <00:23:38.485>works.

558
00:23:38.885 --> 00:23:40.945
<00:23:38.885>As <00:23:39.235>I <00:23:39.585>have <00:23:39.935>definitely <00:23:40.285>learned,

559
00:23:40.945 --> 00:23:43.705
<00:23:40.945>having <00:23:41.100>worked <00:23:41.256>on <00:23:41.411>a <00:23:41.567>large <00:23:41.722>open <00:23:41.878>source <00:23:42.033>project <00:23:42.189>before <00:23:42.345>this

560
00:23:43.705 --> 00:23:46.445
<00:23:43.705>and <00:23:43.845>having <00:23:43.985>to <00:23:44.125>refactor <00:23:44.264>a <00:23:44.405>fair <00:23:44.544>amount <00:23:44.685>of <00:23:44.824>our <00:23:44.965>code <00:23:45.105>base

561
00:23:46.645 --> 00:23:48.845
<00:23:46.645>'cause <00:23:46.878>a <00:23:47.111>dependency <00:23:47.345>later <00:23:47.578>had <00:23:47.811>a <00:23:48.045>security

562
00:23:48.845 --> 00:23:50.445
<00:23:48.845>vulnerability <00:23:50.245>reported.

563
00:23:50.945 --> 00:23:54.125
<00:23:50.945>Uh, <00:23:51.085>this <00:23:51.225>is <00:23:51.365>where <00:23:51.504>our <00:23:51.645>trustee <00:23:51.784>pal <00:23:51.925>depend <00:23:52.064>bot <00:23:52.205>comes <00:23:52.345>in

564
00:23:54.125 --> 00:23:55.325
<00:23:54.125>for <00:23:54.395>many <00:23:54.665>of <00:23:54.935>our <00:23:55.205>projects.

565
00:23:55.745 --> 00:23:58.885
<00:23:55.745>So <00:23:55.919>depend, <00:23:56.094>bot <00:23:56.270>will <00:23:56.445>proactively <00:23:56.620>notify <00:23:56.794>you <00:23:56.969>when <00:23:57.145>your

566
00:23:59.125 --> 00:24:01.125
<00:23:59.125>repository <00:23:59.475>has <00:23:59.825>a <00:24:00.175>vulnerable <00:24:00.525>dependencies.

567
00:24:01.625 --> 00:24:03.045
<00:24:01.625>It <00:24:01.880>is <00:24:02.136>triggered <00:24:02.391>in <00:24:02.647>two <00:24:02.903>ways.

568
00:24:03.305 --> 00:24:05.925
<00:24:03.305>One, <00:24:03.460>when <00:24:03.616>there <00:24:03.771>is <00:24:03.927>a <00:24:04.082>change <00:24:04.238>to <00:24:04.393>your <00:24:04.549>dependency <00:24:04.705>graph.

569
00:24:06.305 --> 00:24:08.845
<00:24:06.305>So <00:24:06.505>that <00:24:06.705>is <00:24:06.905>dependencies <00:24:07.105>that <00:24:07.305>you <00:24:07.505>are <00:24:07.705>including

570
00:24:08.865 --> 00:24:10.685
<00:24:08.865>or <00:24:09.215>dependencies <00:24:09.565>that <00:24:09.915>they <00:24:10.265>include,

571
00:24:11.145 --> 00:24:12.765
<00:24:11.145>or <00:24:11.495>new <00:24:11.845>advisories <00:24:12.195>being <00:24:12.545>added

572
00:24:12.765 --> 00:24:15.285
<00:24:12.765>to <00:24:12.965>the <00:24:13.165>GitHub <00:24:13.365>advisory <00:24:13.565>database <00:24:13.765>at <00:24:13.965>any <00:24:14.165>point.

573
00:24:16.415 --> 00:24:20.815
<00:24:16.415>One <00:24:16.881>moment <00:24:17.348>please. <00:24:17.815>Now,

574
00:24:20.815 --> 00:24:22.495
<00:24:20.815>these <00:24:21.095>alerts <00:24:21.375>actually <00:24:21.655>contain <00:24:21.935>a <00:24:22.215>lot

575
00:24:22.495 --> 00:24:23.895
<00:24:22.495>of <00:24:22.915>really <00:24:23.335>useful <00:24:23.754>information.

576
00:24:23.925 --> 00:24:27.455
<00:24:23.925>They <00:24:24.125>include <00:24:24.325>a <00:24:24.524>link <00:24:24.725>to <00:24:24.925>the <00:24:25.125>affected <00:24:25.325>file,

577
00:24:29.255 --> 00:24:31.415
<00:24:29.255>a <00:24:29.382>link <00:24:29.509>to <00:24:29.636>the, <00:24:29.764>oh <00:24:29.891>yeah, <00:24:30.018>it's <00:24:30.145>up <00:24:30.273>there <00:24:30.400>at <00:24:30.527>the <00:24:30.655>top.

578
00:24:31.475 --> 00:24:33.095
<00:24:31.475>You <00:24:31.675>see <00:24:31.875>the <00:24:32.074>path <00:24:32.274>for <00:24:32.475>the <00:24:32.675>file <00:24:32.875>there.

579
00:24:33.815 --> 00:24:37.025
<00:24:33.815>Information <00:24:33.990>about <00:24:34.165>a <00:24:34.340>version <00:24:34.515>that <00:24:34.690>has <00:24:34.865>had <00:24:35.040>a <00:24:35.215>patch

580
00:24:37.285 --> 00:24:39.065
<00:24:37.285>to <00:24:37.518>the <00:24:37.751>vulnerability <00:24:37.985>that <00:24:38.218>has <00:24:38.451>been <00:24:38.685>reported,

581
00:24:39.525 --> 00:24:41.945
<00:24:39.525>and <00:24:39.758>information <00:24:39.991>about <00:24:40.225>whether <00:24:40.458>a <00:24:40.691>dependency <00:24:40.925>is

582
00:24:42.105 --> 00:24:43.345
<00:24:42.105>direct <00:24:42.663>or <00:24:43.221>transitive.

583
00:24:43.645 --> 00:24:47.625
<00:24:43.645>So <00:24:43.785>direct <00:24:43.925>dependency <00:24:44.065>is <00:24:44.205>one <00:24:44.345>that <00:24:44.485>you <00:24:44.625>man, <00:24:44.764>uh, <00:24:44.905>NPM <00:24:45.045>install.

584
00:24:47.805 --> 00:24:50.265
<00:24:47.805>You <00:24:48.005>know, <00:24:48.205>it's, <00:24:48.405>I <00:24:48.605>have <00:24:48.805>explicitly <00:24:49.005>included <00:24:49.205>it.

585
00:24:50.405 --> 00:24:53.105
<00:24:50.405>And <00:24:50.605>transitive <00:24:50.805>dependencies <00:24:51.004>are <00:24:51.205>all <00:24:51.405>of <00:24:51.605>the <00:24:51.805>dependencies,

586
00:24:53.275 --> 00:24:55.945
<00:24:53.275>which <00:24:53.475>those <00:24:53.675>dependencies <00:24:53.875>use <00:24:54.075>and <00:24:54.275>those <00:24:54.475>dependencies <00:24:54.675>use

587
00:24:55.945 --> 00:24:57.105
<00:24:55.945>and <00:24:56.293>those <00:24:56.641>dependencies <00:24:56.989>use,

588
00:24:57.455 --> 00:24:58.865
<00:24:57.455>they <00:24:57.666>do <00:24:57.878>need <00:24:58.089>to <00:24:58.301>be <00:24:58.512>triaged <00:24:58.724>differently.

589
00:24:58.865 --> 00:25:01.425
<00:24:58.865>You <00:24:59.040>don't <00:24:59.215>always <00:24:59.390>have <00:24:59.565>control <00:24:59.740>over <00:24:59.915>those <00:25:00.090>lower <00:25:00.265>level

590
00:25:01.595 --> 00:25:02.945
<00:25:01.595>transitive <00:25:02.810>dependencies

591
00:25:03.085 --> 00:25:04.785
<00:25:03.085>or <00:25:03.240>you <00:25:03.396>might <00:25:03.551>need <00:25:03.707>to <00:25:03.862>go <00:25:04.018>in <00:25:04.173>and <00:25:04.329>patch, <00:25:04.485>right?

592
00:25:04.785 --> 00:25:06.545
<00:25:04.785>You <00:25:04.925>might <00:25:05.065>need <00:25:05.205>to <00:25:05.345>go <00:25:05.485>in <00:25:05.625>and <00:25:05.765>patch <00:25:05.905>those <00:25:06.045>as <00:25:06.185>well.

593
00:25:07.145 --> 00:25:10.945
<00:25:07.145>Depender <00:25:07.320>bot <00:25:07.495>alerts <00:25:07.670>also <00:25:07.845>contain <00:25:08.020>elements <00:25:08.195>like <00:25:08.370>the <00:25:08.545>CVSS,

594
00:25:11.045 --> 00:25:13.025
<00:25:11.045>the <00:25:11.245>severity <00:25:11.445>that's <00:25:11.645>in <00:25:11.845>the <00:25:12.045>top <00:25:12.245>right <00:25:12.445>there.

595
00:25:13.025 --> 00:25:15.825
<00:25:13.025>7.1 <00:25:13.225>out <00:25:13.425>of <00:25:13.625>10, <00:25:13.825>which <00:25:14.025>says <00:25:14.225>high, <00:25:14.425>right?

596
00:25:16.405 --> 00:25:19.465
<00:25:16.405>And <00:25:16.605>then <00:25:16.805>the, <00:25:17.004>uh, <00:25:17.205>the <00:25:17.405>exploitation <00:25:17.605>risk <00:25:17.805>score,

597
00:25:19.465 --> 00:25:20.665
<00:25:19.465>that's <00:25:19.681>down <00:25:19.897>here <00:25:20.112>at <00:25:20.329>the <00:25:20.545>bottom,

598
00:25:20.805 --> 00:25:23.145
<00:25:20.805>the <00:25:21.085>E-P-S-S-I <00:25:21.365>believe <00:25:21.645>the <00:25:21.925>acronym <00:25:22.205>is.

599
00:25:23.285 --> 00:25:25.505
<00:25:23.285>And <00:25:23.440>this <00:25:23.596>is <00:25:23.751>saying, <00:25:23.907>Hey, <00:25:24.062>within <00:25:24.218>the <00:25:24.373>next <00:25:24.529>short <00:25:24.685>period,

600
00:25:25.685 --> 00:25:28.745
<00:25:25.685>the <00:25:25.860>chance <00:25:26.034>of <00:25:26.210>this <00:25:26.385>vulnerability <00:25:26.560>actually <00:25:26.735>being <00:25:26.909>exploited <00:25:27.085>is

601
00:25:28.955 --> 00:25:30.225
<00:25:28.955>relatively <00:25:29.526>low, <00:25:30.098>right?

602
00:25:30.225 --> 00:25:31.825
<00:25:30.225>It's <00:25:30.458>in, <00:25:30.691>it's <00:25:30.925>in <00:25:31.158>the <00:25:31.391>fifth <00:25:31.625>percentile.

603
00:25:32.035 --> 00:25:33.345
<00:25:32.035>These <00:25:32.231>are <00:25:32.428>just <00:25:32.624>tools <00:25:32.821>to <00:25:33.017>help <00:25:33.214>you

604
00:25:33.345 --> 00:25:35.945
<00:25:33.345>as <00:25:33.520>a <00:25:33.695>team <00:25:33.870>prioritize <00:25:34.045>your <00:25:34.220>work <00:25:34.395>a <00:25:34.570>little <00:25:34.745>more,

605
00:25:35.975 --> 00:25:38.385
<00:25:35.975>just <00:25:36.149>getting <00:25:36.324>a <00:25:36.500>ton <00:25:36.675>of <00:25:36.850>vulnerabilities <00:25:37.024>thrown <00:25:37.199>at <00:25:37.375>you.

606
00:25:38.385 --> 00:25:40.425
<00:25:38.385>Where <00:25:38.560>am <00:25:38.735>I <00:25:38.910>gonna <00:25:39.085>put <00:25:39.260>my <00:25:39.435>effort <00:25:39.610>when <00:25:39.785>I

607
00:25:40.575 --> 00:25:41.665
<00:25:40.575>only <00:25:40.820>have <00:25:41.065>so <00:25:41.310>much <00:25:41.556>time?

608
00:25:41.665 --> 00:25:43.665
<00:25:41.665>These <00:25:41.865>are <00:25:42.065>tools <00:25:42.264>to <00:25:42.465>help <00:25:42.665>you <00:25:42.865>do <00:25:43.065>that.

609
00:25:44.045 --> 00:25:45.985
<00:25:44.045>So <00:25:44.278>depender <00:25:44.511>bot <00:25:44.745>can <00:25:44.978>also <00:25:45.211>be <00:25:45.445>configured

610
00:25:45.985 --> 00:25:47.785
<00:25:45.985>to <00:25:46.334>automatically <00:25:46.685>open <00:25:47.034>pull <00:25:47.385>requests

611
00:25:48.005 --> 00:25:51.025
<00:25:48.005>to <00:25:48.205>bump <00:25:48.405>dependency <00:25:48.605>versions <00:25:48.805>in <00:25:49.005>your <00:25:49.205>manifest <00:25:49.405>file.

612
00:25:51.025 --> 00:25:52.025
<00:25:51.025>So <00:25:51.325>that's <00:25:51.625>your <00:25:51.925>package.

613
00:25:52.165 --> 00:25:55.145
<00:25:52.165>Do <00:25:52.365>j <00:25:52.565>your <00:25:52.764>gem <00:25:52.965>file, <00:25:53.165>your <00:25:53.365>palm <00:25:53.565>xml,

614
00:25:55.345 --> 00:25:58.345
<00:25:55.345>whatever <00:25:55.578>your <00:25:55.811>your <00:25:56.045>ecosystem <00:25:56.278>uses <00:25:56.511>to <00:25:56.745>define

615
00:25:58.405 --> 00:25:59.745
<00:25:58.405>and <00:25:59.008>manage <00:25:59.610>dependencies.

616
00:26:00.405 --> 00:26:01.865
<00:26:00.405>And <00:26:00.624>that's <00:26:00.843>kind <00:26:01.062>of <00:26:01.281>the <00:26:01.500>final <00:26:01.719>pillar

617
00:26:01.865 --> 00:26:03.225
<00:26:01.865>of <00:26:02.273>GitHub <00:26:02.681>Advanced <00:26:03.089>security,

618
00:26:03.225 --> 00:26:06.465
<00:26:03.225>which <00:26:03.399>is <00:26:03.574>depend <00:26:03.750>bot <00:26:03.925>helping <00:26:04.100>secure <00:26:04.274>your <00:26:04.449>supply <00:26:04.625>chain

619
00:26:06.535 --> 00:26:08.945
<00:26:06.535>through <00:26:07.001>proactive <00:26:07.468>monitoring <00:26:07.935>alerts

620
00:26:09.045 --> 00:26:12.385
<00:26:09.045>and <00:26:09.278>remedial <00:26:09.511>pool <00:26:09.745>requests <00:26:09.978>for <00:26:10.211>vulnerable <00:26:10.445>dependencies.

621
00:26:13.165 --> 00:26:15.825
<00:26:13.165>The <00:26:13.320>final <00:26:13.476>little <00:26:13.631>thing <00:26:13.787>I <00:26:13.942>wanna <00:26:14.098>tell <00:26:14.253>you <00:26:14.409>about <00:26:14.565>is

622
00:26:16.345 --> 00:26:19.465
<00:26:16.345>security <00:26:16.520>campaigns, <00:26:16.695>which <00:26:16.870>makes <00:26:17.045>it, <00:26:17.220>uh, <00:26:17.395>easy <00:26:17.570>for <00:26:17.745>developers

623
00:26:19.465 --> 00:26:22.665
<00:26:19.465>and <00:26:19.665>security <00:26:19.865>teams <00:26:20.064>to <00:26:20.264>prioritize <00:26:20.465>risks <00:26:20.665>within <00:26:20.865>their

624
00:26:22.665 --> 00:26:24.905
<00:26:22.665>organization <00:26:22.898>and <00:26:23.131>then <00:26:23.365>make <00:26:23.598>sure <00:26:23.831>that <00:26:24.065>those

625
00:26:24.905 --> 00:26:27.025
<00:26:24.905>that <00:26:25.060>are <00:26:25.216>being <00:26:25.371>tackled <00:26:25.527>are <00:26:25.682>being <00:26:25.838>tackled <00:26:25.993>within <00:26:26.149>a <00:26:26.305>given

626
00:26:27.095 --> 00:26:30.785
<00:26:27.095>timeframe <00:26:27.328>across <00:26:27.561>all <00:26:27.795>repositories <00:26:28.028>in <00:26:28.261>the <00:26:28.495>organization,

627
00:26:31.325 --> 00:26:33.625
<00:26:31.325>we <00:26:31.525>have <00:26:31.725>found <00:26:31.925>that <00:26:32.125>teams <00:26:32.325>that, <00:26:32.525>uh, <00:26:32.725>organizations

628
00:26:33.705 --> 00:26:36.465
<00:26:33.705>that <00:26:33.985>use <00:26:34.264>security <00:26:34.544>campaigns <00:26:34.824>fix <00:26:35.105>five

629
00:26:36.465 --> 00:26:37.825
<00:26:36.465>and <00:26:36.709>a <00:26:36.954>half <00:26:37.199>times <00:26:37.444>more <00:26:37.689>security

630
00:26:37.825 --> 00:26:39.465
<00:26:37.825>vulnerabilities <00:26:38.291>than <00:26:38.758>they <00:26:39.225>don't.

631
00:26:39.685 --> 00:26:41.945
<00:26:39.685>And <00:26:39.918>this <00:26:40.151>is <00:26:40.385>also <00:26:40.618>directly <00:26:40.851>integrated <00:26:41.085>trying

632
00:26:41.945 --> 00:26:45.045
<00:26:41.945>to <00:26:42.120>bring <00:26:42.294>these <00:26:42.470>tools <00:26:42.645>together <00:26:42.820>with <00:26:42.995>copilot <00:26:43.169>auto <00:26:43.345>fixx,

633
00:26:45.175 --> 00:26:48.405
<00:26:45.175>which <00:26:45.408>can <00:26:45.641>immediately <00:26:45.875>open <00:26:46.108>pool <00:26:46.341>requests <00:26:46.575>to,

634
00:26:48.405 --> 00:26:51.285
<00:26:48.405>to <00:26:48.638>start <00:26:48.871>remediating <00:26:49.105>these <00:26:49.338>vulnerabilities <00:26:49.571>across <00:26:49.805>loads

635
00:26:51.285 --> 00:26:53.805
<00:26:51.285>of <00:26:51.635>repositories <00:26:51.985>within <00:26:52.335>an <00:26:52.685>organizations,

636
00:26:54.385 --> 00:26:55.525
<00:26:54.385>uh, <00:26:54.727>within <00:26:55.069>their <00:26:55.411>organizations.

637
00:26:55.765 --> 00:26:57.685
<00:26:55.765>Security <00:26:55.998>managers <00:26:56.231>can <00:26:56.465>also, <00:26:56.698>uh, <00:26:56.931>opt <00:26:57.165>in

638
00:26:57.685 --> 00:26:59.565
<00:26:57.685>to <00:26:57.965>have <00:26:58.245>issues <00:26:58.524>created <00:26:58.804>in <00:26:59.085>all

639
00:26:59.705 --> 00:27:02.885
<00:26:59.705>of <00:26:59.985>the <00:27:00.264>repositories <00:27:00.544>within <00:27:00.824>their <00:27:01.105>organization,

640
00:27:03.135 --> 00:27:06.005
<00:27:03.135>which <00:27:03.335>have <00:27:03.535>this <00:27:03.735>vulnerability <00:27:03.935>present, <00:27:04.135>which <00:27:04.335>allow <00:27:04.535>teams

641
00:27:06.065 --> 00:27:07.205
<00:27:06.065>to <00:27:06.321>then <00:27:06.578>use <00:27:06.834>that <00:27:07.091>issue

642
00:27:07.385 --> 00:27:09.485
<00:27:07.385>to <00:27:07.560>actually <00:27:07.735>manage <00:27:07.910>their <00:27:08.085>work <00:27:08.260>in <00:27:08.435>the <00:27:08.610>same <00:27:08.785>way

643
00:27:09.485 --> 00:27:11.645
<00:27:09.485>that <00:27:09.659>they <00:27:09.834>would <00:27:10.010>manage <00:27:10.185>all <00:27:10.360>of <00:27:10.534>their <00:27:10.709>other <00:27:10.885>work.

644
00:27:12.685 --> 00:27:15.605
<00:27:12.685>Security <00:27:12.885>should <00:27:13.085>be <00:27:13.284>part <00:27:13.485>of <00:27:13.685>every <00:27:13.885>developer's <00:27:14.085>responsibility,

645
00:27:15.605 --> 00:27:17.325
<00:27:15.605>whether <00:27:15.885>we <00:27:16.165>like <00:27:16.445>it <00:27:16.725>or <00:27:17.005>not.

646
00:27:17.705 --> 00:27:20.445
<00:27:17.705>And <00:27:17.879>the <00:27:18.054>whole <00:27:18.230>point <00:27:18.405>of <00:27:18.580>GitHub <00:27:18.754>advanced <00:27:18.929>security <00:27:19.105>is

647
00:27:20.445 --> 00:27:23.525
<00:27:20.445>to <00:27:20.620>embed <00:27:20.794>this <00:27:20.970>directly <00:27:21.145>inside <00:27:21.320>of <00:27:21.495>your <00:27:21.669>workflow <00:27:21.845>with

648
00:27:23.585 --> 00:27:25.205
<00:27:23.585>as <00:27:23.935>little <00:27:24.285>friction <00:27:24.635>as <00:27:24.985>possible.

649
00:27:25.425 --> 00:27:28.085
<00:27:25.425>And <00:27:25.625>this <00:27:25.825>helps <00:27:26.024>strengthen <00:27:26.225>our <00:27:26.425>individual <00:27:26.625>security <00:27:26.825>posture

650
00:27:28.265 --> 00:27:29.565
<00:27:28.265>and <00:27:28.499>our <00:27:28.733>knowledge <00:27:28.967>in <00:27:29.201>the <00:27:29.435>case

651
00:27:29.565 --> 00:27:31.445
<00:27:29.565>of <00:27:29.798>the <00:27:30.031>educational <00:27:30.265>pieces <00:27:30.498>I <00:27:30.731>showed <00:27:30.965>you,

652
00:27:31.585 --> 00:27:33.925
<00:27:31.585>but <00:27:31.865>also <00:27:32.145>our <00:27:32.425>collective <00:27:32.705>security <00:27:32.985>posture.

653
00:27:34.465 --> 00:27:35.845
<00:27:34.465>And <00:27:34.713>also <00:27:34.961>try <00:27:35.210>to, <00:27:35.458>you <00:27:35.707>know,

654
00:27:35.845 --> 00:27:39.565
<00:27:35.845>really <00:27:36.045>prioritize <00:27:36.245>the <00:27:36.445>best <00:27:36.645>possible <00:27:36.845>developer <00:27:37.045>experience <00:27:37.245>in

655
00:27:39.565 --> 00:27:43.285
<00:27:39.565>a <00:27:39.692>world <00:27:39.819>which, <00:27:39.946>you <00:27:40.074>know, <00:27:40.201>can <00:27:40.328>in <00:27:40.455>some <00:27:40.583>ways, <00:27:40.710>in <00:27:40.837>some <00:27:40.965>context,

656
00:27:43.505 --> 00:27:46.685
<00:27:43.505>in <00:27:43.680>some, <00:27:43.855>you <00:27:44.030>know, <00:27:44.205>examples <00:27:44.380>actually <00:27:44.555>provide <00:27:44.730>a <00:27:44.905>lot

657
00:27:46.685 --> 00:27:48.565
<00:27:46.685>of <00:27:46.918>additional <00:27:47.151>friction <00:27:47.385>and <00:27:47.618>tools <00:27:47.851>that <00:27:48.085>you

658
00:27:48.565 --> 00:27:50.725
<00:27:48.565>and <00:27:48.915>integrations <00:27:49.265>that <00:27:49.615>you <00:27:49.965>need.

659
00:27:51.145 --> 00:27:53.205
<00:27:51.145>So <00:27:51.272>just <00:27:51.399>to <00:27:51.526>kind <00:27:51.654>of <00:27:51.781>talk <00:27:51.908>you <00:27:52.035>through <00:27:52.163>this, <00:27:52.290>the <00:27:52.417>pen <00:27:52.545>bot

660
00:27:53.205 --> 00:27:55.485
<00:27:53.205>and <00:27:53.485>security <00:27:53.764>campaigns <00:27:54.044>can <00:27:54.324>open <00:27:54.605>issues.

661
00:27:55.485 --> 00:27:57.325
<00:27:55.485>This <00:27:55.640>is <00:27:55.796>where <00:27:55.951>a <00:27:56.107>lot <00:27:56.262>of <00:27:56.418>our <00:27:56.573>work <00:27:56.729>begins, <00:27:56.885>right?

662
00:27:57.325 --> 00:28:00.605
<00:27:57.325>An <00:27:57.480>actual <00:27:57.636>issue <00:27:57.791>being <00:27:57.947>reported <00:27:58.102>quite <00:27:58.258>often, <00:27:58.413>a <00:27:58.569>feature <00:27:58.725>branch

663
00:28:00.625 --> 00:28:04.045
<00:28:00.625>or <00:28:00.752>a, <00:28:00.879>you <00:28:01.006>know, <00:28:01.134>a <00:28:01.261>branch <00:28:01.388>to, <00:28:01.515>to <00:28:01.643>fix <00:28:01.770>problems <00:28:01.897>is <00:28:02.025>created

664
00:28:04.145 --> 00:28:08.485
<00:28:04.145>and <00:28:04.285>work <00:28:04.425>happens, <00:28:04.565>uh, <00:28:04.705>inside <00:28:04.845>of <00:28:04.985>that <00:28:05.125>branch <00:28:05.264>within <00:28:05.405>your <00:28:05.545>IDE,

665
00:28:08.485 --> 00:28:10.725
<00:28:08.485>you <00:28:08.718>can <00:28:08.951>use <00:28:09.185>copilot <00:28:09.418>code <00:28:09.651>review, <00:28:09.885>um,

666
00:28:10.905 --> 00:28:12.845
<00:28:10.905>to <00:28:11.138>be <00:28:11.371>helping <00:28:11.605>you <00:28:11.838>write <00:28:12.071>better <00:28:12.305>codes

667
00:28:12.865 --> 00:28:15.645
<00:28:12.865>and <00:28:13.040>then <00:28:13.215>use <00:28:13.390>push <00:28:13.565>protection <00:28:13.740>to <00:28:13.915>make <00:28:14.090>sure <00:28:14.265>secrets

668
00:28:15.805 --> 00:28:17.365
<00:28:15.805>and <00:28:16.038>tokens, <00:28:16.271>things <00:28:16.505>we <00:28:16.738>don't <00:28:16.971>want <00:28:17.205>people

669
00:28:17.365 --> 00:28:21.125
<00:28:17.365>to <00:28:17.492>see <00:28:17.619>are <00:28:17.746>never <00:28:17.874>making <00:28:18.001>it, <00:28:18.128>uh, <00:28:18.255>off <00:28:18.383>of <00:28:18.510>our <00:28:18.637>own <00:28:18.765>machine.

670
00:28:21.435 --> 00:28:22.845
<00:28:21.435>Then <00:28:21.646>we're <00:28:21.858>inside <00:28:22.069>of <00:28:22.281>a <00:28:22.492>pool <00:28:22.704>request.

671
00:28:22.845 --> 00:28:25.245
<00:28:22.845>This <00:28:22.985>is <00:28:23.125>where <00:28:23.265>all <00:28:23.405>of <00:28:23.545>our <00:28:23.685>GitHub <00:28:23.825>actions <00:28:23.965>workflows <00:28:24.105>come <00:28:24.245>in,

672
00:28:25.535 --> 00:28:29.205
<00:28:25.535>dependency <00:28:25.710>reviews, <00:28:25.885>the <00:28:26.060>code, <00:28:26.235>QL <00:28:26.410>checks <00:28:26.585>and <00:28:26.760>so <00:28:26.935>on.

673
00:28:29.465 --> 00:28:32.085
<00:28:29.465>And <00:28:29.639>then <00:28:29.814>finally, <00:28:29.990>we <00:28:30.165>merge <00:28:30.340>that <00:28:30.514>in <00:28:30.689>a <00:28:30.865>few

674
00:28:32.085 --> 00:28:35.405
<00:28:32.085>of <00:28:32.260>our <00:28:32.435>ongoing <00:28:32.610>tools <00:28:32.785>include <00:28:32.960>the <00:28:33.135>supply <00:28:33.310>chain <00:28:33.485>security

675
00:28:35.675 --> 00:28:38.525
<00:28:35.675>with <00:28:35.875>depend <00:28:36.075>bot, <00:28:36.274>which <00:28:36.475>will <00:28:36.675>be <00:28:36.875>proactively, <00:28:37.075>uh,

676
00:28:38.605 --> 00:28:41.565
<00:28:38.605>alerting <00:28:38.885>you <00:28:39.165>when <00:28:39.445>vulnerabilities <00:28:39.725>are <00:28:40.005>disclosed.

677
00:28:42.015 --> 00:28:43.365
<00:28:42.015>Continuous <00:28:42.622>code <00:28:43.230>scanning,

678
00:28:43.575 --> 00:28:45.405
<00:28:43.575>which <00:28:43.808>also <00:28:44.041>will <00:28:44.275>appear <00:28:44.508>in <00:28:44.741>the <00:28:44.975>security

679
00:28:45.505 --> 00:28:46.725
<00:28:45.505>tab <00:28:45.871>of <00:28:46.237>your <00:28:46.602>repository.

680
00:28:47.105 --> 00:28:48.285
<00:28:47.105>And <00:28:47.370>just <00:28:47.636>again, <00:28:47.901>a <00:28:48.167>reminder

681
00:28:48.285 --> 00:28:50.285
<00:28:48.285>that <00:28:48.485>secrets <00:28:48.685>don't <00:28:48.885>just <00:28:49.085>exist <00:28:49.285>in <00:28:49.485>our <00:28:49.685>code

682
00:28:50.545 --> 00:28:51.885
<00:28:50.545>and <00:28:50.846>in <00:28:51.148>our <00:28:51.449>code <00:28:51.751>history,

683
00:28:52.185 --> 00:28:55.085
<00:28:52.185>but <00:28:52.385>also <00:28:52.585>sometimes <00:28:52.784>in <00:28:52.985>issues <00:28:53.185>in <00:28:53.385>pool <00:28:53.585>request

684
00:28:55.085 --> 00:28:56.205
<00:28:55.085>discussions <00:28:55.589>and <00:28:56.092>wikis.

685
00:28:56.305 --> 00:28:58.925
<00:28:56.305>So <00:28:56.460>all <00:28:56.616>of <00:28:56.771>those <00:28:56.927>are <00:28:57.082>being <00:28:57.238>proactively <00:28:57.393>scanned <00:28:57.549>as <00:28:57.705>well.

686
00:28:59.545 --> 00:29:02.405
<00:28:59.545>So <00:28:59.700>this <00:28:59.856>is, <00:29:00.011>you <00:29:00.167>know, <00:29:00.322>quite <00:29:00.478>a <00:29:00.633>lot <00:29:00.789>of <00:29:00.945>tools

687
00:29:02.505 --> 00:29:05.805
<00:29:02.505>and <00:29:02.645>what <00:29:02.785>I'm <00:29:02.925>really <00:29:03.065>hoping <00:29:03.205>you <00:29:03.345>are <00:29:03.485>walking <00:29:03.625>away <00:29:03.765>from <00:29:03.905>this,

688
00:29:05.825 --> 00:29:08.685
<00:29:05.825>uh, <00:29:05.952>half <00:29:06.079>an <00:29:06.206>hour <00:29:06.334>with <00:29:06.461>is <00:29:06.588>more <00:29:06.715>of <00:29:06.843>a <00:29:06.970>knowledge <00:29:07.097>about <00:29:07.225>some

689
00:29:08.685 --> 00:29:11.085
<00:29:08.685>of <00:29:08.918>these <00:29:09.151>tools <00:29:09.385>that <00:29:09.618>I <00:29:09.851>certainly <00:29:10.085>didn't

690
00:29:11.525 --> 00:29:12.565
<00:29:11.525>previously <00:29:11.993>know <00:29:12.461>existed.

691
00:29:12.945 --> 00:29:14.085
<00:29:12.945>And <00:29:13.287>hopefully <00:29:13.629>you'll <00:29:13.971>agree

692
00:29:14.085 --> 00:29:17.325
<00:29:14.085>that <00:29:14.240>they <00:29:14.396>can <00:29:14.551>slot <00:29:14.707>quite <00:29:14.862>easily <00:29:15.018>into <00:29:15.173>your <00:29:15.329>existing <00:29:15.485>workflows

693
00:29:17.425 --> 00:29:20.205
<00:29:17.425>and <00:29:17.600>help <00:29:17.774>all <00:29:17.950>of <00:29:18.125>us <00:29:18.300>write <00:29:18.475>more <00:29:18.649>secure <00:29:18.825>codes

694
00:29:20.225 --> 00:29:21.405
<00:29:20.225>and <00:29:20.579>have <00:29:20.933>less <00:29:21.287>vulnerabilities.

695
00:29:22.065 --> 00:29:24.085
<00:29:22.065>Um, <00:29:22.345>if <00:29:22.625>you <00:29:22.905>have <00:29:23.185>any <00:29:23.465>questions,

696
00:29:24.115 --> 00:29:26.565
<00:29:24.115>I'll <00:29:24.231>be <00:29:24.348>over <00:29:24.465>on <00:29:24.581>the <00:29:24.698>GitHub <00:29:24.815>booth, <00:29:24.931>uh, <00:29:25.048>for <00:29:25.165>the <00:29:25.281>rest <00:29:25.398>of <00:29:25.515>today.

697
00:29:27.025 --> 00:29:28.885
<00:29:27.025>Um, <00:29:27.258>I <00:29:27.491>just <00:29:27.725>wanna <00:29:27.958>finish <00:29:28.191>by <00:29:28.425>saying

698
00:29:28.885 --> 00:29:30.205
<00:29:28.885>that <00:29:29.182>we <00:29:29.479>understand <00:29:29.775>our <00:29:30.072>role

699
00:29:30.205 --> 00:29:32.565
<00:29:30.205>and <00:29:30.485>responsibility <00:29:30.764>in <00:29:31.044>helping <00:29:31.324>developers <00:29:31.605>build

700
00:29:32.625 --> 00:29:34.205
<00:29:32.625>and <00:29:32.975>publish <00:29:33.325>more <00:29:33.675>secure <00:29:34.025>software.

701
00:29:34.505 --> 00:29:37.365
<00:29:34.505>So <00:29:34.660>thank <00:29:34.816>you <00:29:34.971>so <00:29:35.127>much, <00:29:35.282>uh, <00:29:35.438>for <00:29:35.593>your <00:29:35.749>entrusting <00:29:35.905>me

702
00:29:37.595 --> 00:29:38.885
<00:29:37.595>with <00:29:37.788>half <00:29:37.982>an <00:29:38.175>hour <00:29:38.369>of <00:29:38.562>your <00:29:38.756>time.

703
00:29:39.305 --> 00:29:40.965
<00:29:39.305>Uh, <00:29:39.505>I <00:29:39.705>hope <00:29:39.905>you <00:29:40.105>entrust <00:29:40.305>me <00:29:40.505>with <00:29:40.705>more

704
00:29:40.965 --> 00:29:42.445
<00:29:40.965>of <00:29:41.112>your <00:29:41.261>time <00:29:41.408>if <00:29:41.557>you <00:29:41.705>have <00:29:41.852>questions <00:29:42.001>on <00:29:42.149>the <00:29:42.297>booth,

705
00:29:42.645 --> 00:29:43.885
<00:29:42.645>'cause <00:29:42.804>I <00:29:42.963>think <00:29:43.123>I'm <00:29:43.282>just <00:29:43.442>about <00:29:43.601>at <00:29:43.761>time.

706
00:29:44.225 --> 00:29:45.045
<00:29:44.225>Uh, <00:29:44.409>thank <00:29:44.594>you <00:29:44.778>very <00:29:44.963>much.