SARIF
SARIF (Static Analysis Results Interchange Format) is the standard JSON format GitHub uses to ingest and display code-scanning results. It lets CodeQL and third-party analysis tools report findings into Code Security interoperably.
All GH-500 Terms
GitHub Advanced Security
GitHub Advanced Security (GHAS) is the suite of features that secures code, secrets, and dependencies across the software-development lifecycle.
Secret Protection
Secret Protection is the current name for the feature formerly called secret scanning, which detects credentials and tokens committed to a repository.
Push Protection
Push Protection is a Secret Protection capability that blocks commits containing detected secrets before they reach the remote repository.
Code Security
Code Security is the current name for code scanning with CodeQL, the feature that analyzes source code for vulnerabilities and errors.
CodeQL
CodeQL is GitHub's semantic code-analysis engine that queries code as data to find security vulnerabilities.
Supply chain security
Supply chain security is the current umbrella for the features formerly delivered as Dependabot and Dependency Review, protecting a project's dependencies.
Dependabot
Dependabot is the automation that raises alerts and opens pull requests to update vulnerable or outdated dependencies.
Dependency graph
The dependency graph is a representation of the packages and versions a repository depends on, including transitive dependencies.
SBOM
An SBOM (Software Bill of Materials) is a formal, exportable inventory of the components and dependencies in a piece of software.
Dependency Review
Dependency Review is a pre-merge check that shows the security and license impact of dependency changes in a pull request before they are merged.
EPSS
EPSS (Exploit Prediction Scoring System) is a model that estimates the probability that a vulnerability will be exploited in the wild.
SARIF
SARIF (Static Analysis Results Interchange Format) is the standard JSON format GitHub uses to ingest and display code-scanning results.
Security campaign
A security campaign is a coordinated, tracked effort to remediate a defined set of security alerts across repositories.
Security Overview
The Security Overview is a consolidated dashboard that shows the security posture and alert status across an organization's repositories.
Delegated bypass
Delegated bypass is a policy that lets designated reviewers approve or deny requests to bypass a security control such as Push Protection.