How to Scan Your GitHub Repository for Security Vulnerabilities

Why Repositories Are a Security Target

Most developers think of security as a runtime concern — what happens when the application is running in production. But the repository itself is a target:

• Secrets in code: API keys, database credentials, and private keys committed to git (even briefly) are indexed by bots within minutes
• Vulnerable dependencies: A single line in package.json can introduce a known CVE affecting millions of users
• Insecure patterns: SQL injection sinks, missing authentication middleware, and unsafe deserialization are often visible in static analysis before runtime
• Supply chain attacks: Compromised dependencies in your package-lock.json can ship malware to production

GitHub provides tools for all of these. The challenge is knowing which tool covers which risk and how to configure them effectively.

GitHub''s Built-In Security Tools

Dependabot

Dependabot monitors your repository''s dependency files and automatically opens pull requests when a new version fixes a known vulnerability.

What it scans: - package.json / package-lock.json (npm) - requirements.txt / Pipfile / pyproject.toml (Python) - Gemfile.lock (Ruby) - pom.xml / build.gradle (Java) - go.mod (Go) - Cargo.lock (Rust) - composer.lock (PHP) - GitHub Actions workflow files (.github/workflows/*.yml)

How to enable:

Method 1: Via GitHub UI 1. Go to your repository → Security tab → Enable Dependabot alerts 2. Optionally enable Dependabot security updates (auto-creates PRs)

Method 2: Via .github/dependabot.yml file

How to handle Dependabot PRs:

Not every Dependabot PR is safe to merge automatically. Review the PR description — Dependabot explains the CVE and why the version bump is safe. For patch and minor version updates to well-tested packages, auto-merging is reasonable. For major version bumps, review manually.

Enable auto-merge for low-risk updates:

Secret Scanning

GitHub secret scanning checks every push for over 200 patterns corresponding to secrets from major providers: AWS, Stripe, GitHub, Google, Slack, SendGrid, Twilio, and more.

For public repositories: Enabled by default and free.

For private repositories: Requires GitHub Advanced Security (included in GitHub Team and GitHub Enterprise).

How to view alerts:

Repository → Security tab → Secret scanning alerts

Each alert shows: - The secret type (e.g., "Stripe API Key") - The exact commit where it was found - The file and line number - Whether the secret has been validated as active

Push protection: You can also block pushes that contain secrets before they are committed:

Repository → Settings → Security → Secret scanning → Push protection → Enable

With push protection enabled, GitHub blocks the push if it detects a secret pattern. The developer can still override if it is a false positive.

Code Scanning (GitHub Advanced Security / CodeQL)

CodeQL is GitHub''s semantic code analysis engine. Unlike pattern matching, CodeQL understands code flow — it can find vulnerabilities like SQL injection, XSS, and path traversal where user input flows into dangerous sinks across multiple function calls.

For public repositories: Free.

Setup via GitHub Actions:

View results: Repository → Security tab → Code scanning alerts

External Tools for Deeper Scanning

ZeriFlow Advanced Scan

ZeriFlow accepts a GitHub repository URL or ZIP upload and runs a combined scan covering:

• Hardcoded secrets (API keys, tokens, credentials)
• CVEs in dependencies with exploitability context
• Insecure API patterns (missing auth middleware, open debug endpoints, unsafe HTTP methods)

The combined report gives you a security score and a prioritized fix list. Useful before major releases, security reviews, or when onboarding a legacy codebase.

Snyk

Snyk offers deep dependency and code scanning with a developer-friendly UI:

GitHub integration: Snyk can be added as a GitHub App that comments on pull requests with vulnerability findings.

OSSF Scorecard

The OpenSSF Scorecard evaluates your repository against security best practices across 18 checks:

Or use the GitHub Action:

Building an Automated Scanning Pipeline

A complete GitHub security scanning pipeline runs on every push and pull request:

This pipeline runs three checks on every pull request: 1. npm audit — blocks PRs with high/critical dependency vulnerabilities 2. truffleHog — blocks PRs that introduce verified secrets 3. Semgrep — reports SAST findings without blocking (adjust fail_open as needed)

What to Look For and How to Prioritize

Prioritization framework

Not all vulnerability findings require immediate action. Use this framework:

Fix immediately (before merge): - Critical CVSS vulnerabilities in packages that directly handle user input or authentication - Any confirmed hardcoded credential - Verified secrets (truffleHog or GitHub secret scanning confirmed the credential is valid)

Fix within one sprint: - High CVSS vulnerabilities in production dependencies - CodeQL findings with high confidence in authentication, authorization, or injection categories

Fix when convenient: - Moderate vulnerabilities in dev dependencies that do not ship to production - Low confidence SAST findings requiring manual review - Vulnerabilities in packages not used in the vulnerable code path

Reducing false positives

npm audit in particular generates many false positives for vulnerabilities in dev-only dependencies. Use --omit=dev to focus on production dependencies:

For Semgrep findings, add # nosemgrep comments to suppress specific false positives after review:

Document your reasoning for suppressed findings.

Monitoring vs Scanning

Scanning finds vulnerabilities at a point in time. Monitoring finds new vulnerabilities in code that was previously safe.

Dependabot handles the dependency monitoring layer automatically — it watches the advisory databases and opens PRs when new CVEs affect packages you are already using.

For web-level security monitoring (new headers dropping, certificate expiry, DNS changes), use ZeriFlow''s monitoring feature for daily or weekly automated scans with email, Slack, or Discord alerts.

Summary

Scanning your GitHub repository for security vulnerabilities should be automatic and continuous, not manual and occasional. Enable Dependabot for dependency vulnerability PRs, secret scanning for credential leak detection, and CodeQL for semantic code analysis. Add truffleHog and Semgrep to your CI pipeline for additional coverage. Use ZeriFlow''s Advanced Scan for a comprehensive pre-release check covering secrets, CVEs, and insecure API patterns together. Prioritize findings by exploitability in your specific context, and document your reasoning when suppressing false positives.