Code scanning for security vulnerabilities now available
Open Source authors [1] [2] (including myself) have complained of automatic security scans. They yield way too many false positives, increasing the burden of maintaining repositories. Specially troublesome are when e.g. the "vulnerability" (if it's even one) is in a devDependency that is not deployed to production.<p>In theory automatic vulnerability scans sounds great, but having every repo ping you with not-actually-an-issue becomes a chore very quickly. So far the <i>vast majority</i> of vulnerabilities I've seen are actually noise/not applicable. If this code checker is actually good, unlike all of the previous ones, that's another thing and might actually be a game changer.<p>Prominent open source authors have often suggested ways that GIthub can help but seem to be ignored, e.g. allowing to add friction to opening random issues would benefit open source greatly. At some point many beginner devs migrated from StackOverflow to Github because their <i>really bad</i> question were being closed there, and now they just overwhelm open source authors.<p>[1] <a href="https://twitter.com/sindresorhus/status/1123986529498664961" rel="nofollow">https://twitter.com/sindresorhus/status/1123986529498664961</a><p>[2] <a href="https://twitter.com/FPresencia/status/1311551520689713152" rel="nofollow">https://twitter.com/FPresencia/status/1311551520689713152</a>