GitHub can connect controls from code creation and package intake through detection,
remediation, governance, and measurement, so security evidence follows the work instead
of being assembled after the fact.
Proposed architecture only. This page does not represent Zions Bank's current deployment,
adoption, licensing, or availability.
GitHubSecurity control planePolicy, evidence, and remediation in the developer workflow
Code
Packages
Detect
Remediate
Govern
Measure
CreateIntakeDetectRemediateGovernMeasure
CodeQL security lifecycle
Security findings become part of the pull request.
CodeQL models code as data, traces relevant flows, and returns evidence where developers
are already making decisions. Select a stage to follow the control loop.
Pull request
CodeQL analysis requested
01 / Analyze the change
Pull requests trigger CodeQL and code scanning checks.
Analysis runs on the proposed change and reports status through pull request checks.
This brings first-party code risk into the same review path as tests and approvals.
CodeQL models code and follows security-relevant data flow.
Queries can identify issues such as paths where data from an untrusted source reaches
a sensitive sink without the expected validation or sanitization.
Developers see actionable context, not only an alert count.
Results can appear as checks, line annotations, alert details, severity and CWE
metadata, and source-to-sink paths. Configured rulesets or merge protection can block
merges based on selected severities.
Developers remediate with guidance and Copilot Autofix where available.
Alert guidance, code paths, and suggested changes shorten the distance between
detection and a reviewed fix. Repository tests and review remain part of validation.
An alert can be assigned to Copilot cloud agent where available.
The agent explores the repository, creates and validates a fix, and opens a pull
request for human review. Preview behavior and availability can change.
Targeted alertsOwnersDeadline
06 / Coordinate at scale
Security campaigns turn selected alerts into managed remediation work.
Campaigns organize targeted alerts across repositories, assign ownership, track
progress and deadlines, and support assigning campaign alerts to Copilot where
available.
Product availability depends on plan, configuration, repository eligibility, and rollout
status. Preview features are not commitments of future availability.
Dependencies and software supply chain
Use intelligence, policy, and CI as distinct layers.
Each signal answers a different question. Together they help teams decide what entered
the graph, what is known to be risky, and whether a proposed update works in this repository.
01
Curated intelligence
GitHub Advisory Database
A curated foundation for open-source vulnerabilities and malware, with GHSA and CVE
identities plus ecosystem-specific affected and patched versions.
Important boundary
GitHub-reviewed advisories drive Dependabot alerts. Unreviewed NVD advisories do not
create Dependabot alerts until GitHub reviews them.
Dependabot maps advisory intelligence to the repository dependency graph, surfaces
vulnerable dependencies, and can open security update pull requests when a fix is available.
Alert explains the affected dependency and advisory.
Security update PR proposes a version change.
Repository review and CI determine whether that change is acceptable.
A daily-updated estimate of the probability that a vulnerability will be exploited in
the next 30 days. EPSS is a likelihood signal, not a replacement for CVSS severity.
External evidence
Compatibility score
The percentage of CI runs that passed in other public repositories for the same
version-to-version update. It is supporting evidence, not a test of Zions Bank code
and not a guarantee.
Repository evidence
CI and dependency review
Dependabot does not test every PR. Repository CI tests Dependabot-created PRs. The
Dependency Review Action compares base and head dependency changes and can fail a check
for newly introduced vulnerable dependencies.
Rules can target criteria such as CVE ID, GHSA ID, package, ecosystem, severity, scope,
and CWE to auto-dismiss, snooze, or otherwise prioritize matching Dependabot alerts.
CVE / GHSAPackageCWE→Auto-dismissed, still visible
The alert remains auditable. Custom auto-triage rules are configured in repository
settings, not in dependabot.yml.
Move selected package policy checks ahead of installation.
The release direction describes a control between endpoints, builds, agents, and package
registries. It is not GA, is not guaranteed to be available to all customers today, and is
subject to change.
RequestersDeveloperCI buildAI agent
PreviewPackage Firewall
Package cooldown age
Malware advisories
Configurable policy
Initial directionnpm registryPython packages
X
Policy failsBlock before installation
OK
Policy passesContinue to registry
?
Exception neededRequest workflow in preview direction
Preview scope, timing, eligibility, package-manager support, and final behavior may change.
Governance and auditability
Keep the decision, the actor, and the alert connected.
Regulated workflows need durable evidence of security decisions. GitHub can provide
traceability without this page asserting compliance with any specific regulation or certification.
Manual code scanning dismissal
code_scanning.alert_closed_by_user
A manually dismissed code scanning alert produces this action in the enterprise audit
log or audit log stream.
Documented audit event fields identify the alert and actor. They do not list the selected
false-positive reason or free-text comment.
Where rationale remains available
Alert record, API, and webhook
The alert and code scanning REST API or webhook expose
dismissed_reason and dismissed_comment for the recorded rationale.
Dependabot automation
Auto-dismiss remains observable
Dependabot auto-dismiss activity is represented through webhooks, REST and GraphQL APIs,
and the audit log, preserving evidence for review and reporting.
Control objective: retain enough evidence to reconstruct what was detected,
who or what acted, how the alert was dispositioned, and whether remediation work completed.