GitHub Community
How can I ensure my code is secure before submitting a PR? #145762
-
Select Topic AreaQuestion BodyI’m about to submit a pull request for a new feature in my repository, but I want to make sure that it’s secure. |
Beta Was this translation helpful? Give feedback.
Answered by
hylcore-V
Nov 28, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Ensuring your code is secure before submitting a pull request is crucial, especially when it involves sensitive data or infrastructure. Here are some best practices:
Static Code Analysis:
Use static code analysis tools to automatically check for common security vulnerabilities such as SQL injection, cross-site scripting (XSS), and other flaws. Tools like SonarQube, Snyk, and CodeQL can scan your code and highlight potential issues before they become problems.
Secrets Scanning:
Before submitting a PR, ensure that no sensitive information like API keys, database credentials, or tokens are hardcoded in your code. GitHub has Secret Scanning built in to help identify secrets accidentally pushe…