Welcome to the next episode in our GitHub for Beginners series, where we are diving into the world of GitHub Copilot. This is our fourth episode, and we’ve already talked about Copilot in general, some of its essential features, and how to write good prompts to get the most out of Copilot. We have all the previous episodes on our blog and available as videos.
Today we’re going to be talking about security. Everyone knows that you should make your code secure and no one wants to be responsible for any potential hacks. But did you know that GitHub Copilot can help you with some security best practices? We’ll show you how you can use it and other tools to help make your projects more secure from day one.
Let’s talk security
Most security teams, through no fault of their own, don’t have sufficient time or resources to properly secure their companies’ code. That makes developers the first line of defense, which is tough because many developers don’t have enough formal security training to do the job properly. For those who don’t have the proper training, they’re often forced to learn these skills on the job.
Fortunately, GitHub is here to help—both with GitHub Copilot and a bunch of security tools you can use for free if you’re building open source code.
Copilot to the rescue
GitHub Copilot doesn’t just know how to write code; it also understands how to make code more secure. But it isn’t perfect, so you have to know what to ask. You also shouldn’t rely on it as your only security tool.
Let’s start with a simple example.
Let’s say you’re working with a SQL database using an INSERT statement to add data. Now, you may have heard of SQL injection. If you haven’t, or if you need a refresher, that’s where someone sneaks in a malicious command through a regular text field, like a comment box or name input. This could be a command like DROP TABLE, which could delete your entire database.
One way to protect your code is to ask GitHub Copilot to regenerate it. Delete the code that uses the INSERT command and write a clear comment explaining what you want to do. For example, you could insert the following comment:
/*
insert from cart using a parameterized query:
mail, product_name, user_name, product_id, address, phone, ship_date, price" and get a Copilot suggestion
*/
Copilot will suggest a safer, parameterized query—because security shouldn’t be guesswork.
Once you’ve added that comment, if GitHub Copilot is enabled in your IDE, it’ll suggest some code for you. Before accepting the code, be sure to review what Copilot wrote—it’s a helpful assistant, but it’s your job to verify and validate. Once you’ve verified the output, hit Tab to accept the suggestion.
Now, what if you don’t want to delete your existing code? You may have a chunk of code that you want to check. In this case, you can ask Copilot to look through your code and fix it. To do this, highlight the code you want to review, open Copilot Chat and ask “are there any vulnerabilities in this function?”
If you want to expand the scope, you could select the whole file or use @workspace in the Copilot Chat window. Using @workspace tells Copilot to look at all the files in your workspace, not just the ones that you currently have open. A great prompt to try is: “@workspace what’s the attack surface?” That’s a fancy way of asking how someone might try to attack this project.
Copilot will scan your code and offer suggestions it can find. These might include individual changes to the code or certain packages you might want to consider adding to the project to make it more secure.
You can take this a step further by using the slash command /fix, to get suggestions for improving overall code quality and efficiency.
Don’t forget that you can always follow up with more detailed questions after Copilot gives you a response or makes a suggestion. You can ask Copilot questions like:
- “What does this vulnerability mean?”
- “Can you suggest a safer way to do this?”
For more sample prompts, check out our Copilot Chat Cookbook. The section on Finding vulnerabilities is particularly appropriate for this topic.
Dedicated security tools
While Github Copilot is powerful, it’s not meant to replace all your security tools. This is partly because Copilot is a generalist, not a specialist. It can’t always see the full context of your production environment. Built-to-purpose security tools can take other factors into account, such as your compiler, your environment variables, and your deployment method.
Fortunately, GitHub has a number of free security offerings for open source maintainers. This means you can use them at no cost on your public repositories. Let’s take a look at some of them.
Dependabot
If you’ve been working on code in a public GitHub repository, you may have noticed a pull request from someone called dependabot. That’s GitHub’s tool that checks to make sure your dependencies are vulnerability-free and up-to-date.
To enable or disable Dependabot, click the Settings tab for your repository. Scroll down and click Code security in the left-hand menu. In this menu, there is an entire section for Dependabot. You can enable or disable alerts as well as automatic updates.
Code scanning & CodeQL
The next section in a public repository is Code scanning. If you don’t see this section, it likely means you’re working in a private repository. Code scanning will automatically detect common vulnerabilities and coding errors, such as the SQL injection vulnerability we talked about at the beginning of this post. We highly recommend you enable CodeQL analysis.
To do so, click the Set up button, and select Default from the menu that appears. Then click the green Enable CodeQL button at the bottom of the pop up window. This enables GitHub to look for pattern-based vulnerabilities in your code. This happens automatically when you commit new code to your repository, when you make pull requests, and as a periodic scan. If GitHub finds a new problem, it will send you a notification so you can fix it.
Copilot Autofix
If you want to have Copilot automatically suggest fixes to these vulnerabilities, enable Copilot Autofix. It can be found on the Code security page, under the button to Enable CodeQL. With this enabled, GitHub will run Copilot when it discovers a problem, and it will create a pull request with a suggested solution provided by Copilot. Once you review the solution, you’ll have the option to accept the pull request, eliminating the need for you to manually run Copilot to generate a possible solution.
Secret scanning
The next security tool we want to point out is secret scanning. You can find the option for secret scanning at the bottom of the Code security page. By enabling secret scanning, GitHub scans your code to look for possible exposed secrets, such as passwords or security tokens. You never want these directly embedded in your code because of the security risk. With Push protection enabled, GitHub will proactively block any new secrets from being committed to your GitHub-hosted code.
There are several other features that we don’t have time to explore here. If you’d like to read more on your own, check out our documentation about GitHub security features and our quickstart for securing your repository.
Your next steps
Security is an incredibly deep topic, and we don’t expect you to be an expert. For now, remember these three things:
- Ask Copilot to find and fix vulnerabilities. This might be as simple as running
/fixin Copilot Chat, or it could be more detailed such as selecting some code and asking Copilot to check it for vulnerabilities. - Ask Copilot for more details when problems are found. It’s important to understand the solution, both to make sure you can verify its work and also as a learning opportunity to help you in the future.
- Enable Dependabot, code scanning, and secret scanning. These tools in the Code security settings will be useful for sending you alerts when there are potential problems you want to be aware of. And remember that Copilot can help you fix them!
Don’t forget that you can use GitHub Copilot for free! If you have any questions, pop them in the GitHub Community thread, and we’ll be sure to respond. Join us for the next part in this series, where we’ll learn how to build a REST API with Copilot.
Happy coding!
The post GitHub for Beginners: Security best practices with GitHub Copilot appeared first on The GitHub Blog.
Source: Read MoreÂ
