GitHub Security Vocabulary
Practice vocabulary for GitHub security features including Dependabot, secret scanning, GHAS, code scanning alerts, and branch protection rules.
0 / 25 completed
1 / 25
The GitHub feature that automatically opens pull requests to update vulnerable dependencies is called _____.
Dependabot monitors your dependency files and automatically opens pull requests to update packages with known vulnerabilities, reducing exposure to supply-chain attacks.
2 / 25
A 'secret scanning alert' on GitHub means that _____.
GitHub's secret scanning detects accidentally committed credentials (API keys, tokens, passwords) and alerts the team so the secret can be rotated immediately.
3 / 25
GHAS stands for _____ and provides code scanning, secret scanning, and dependency review.
GitHub Advanced Security (GHAS) is a suite of security features — including CodeQL-powered code scanning, secret scanning, and dependency review — available for enterprise and public repositories.
4 / 25
When a code scanning alert is marked as a 'false positive', it means _____.
A false positive is a security alert where the tool incorrectly identified a vulnerability — the code is flagged but is safe in practice, so the alert can be dismissed with a documented rationale.
5 / 25
Branch protection rules on the main branch are typically configured to _____.
Branch protection rules enforce policies such as required reviews, passing CI checks, and blocking force-pushes — protecting the main branch from accidental or malicious overwrites.
6 / 25
Sarah just submitted a Pull Request to update the authentication library in our project. During the code review, David comments: 'This PR introduces a dependency on `libsodium-dev`, which is known to have some recent vulnerabilities. I've flagged this for secret scanning – it's crucial we verify if any secrets are exposed.' Which of the following best describes David's action and concern?
David's action demonstrates proactive security practices within a code review. Secret scanning, particularly when triggered by a new dependency like `libsodium-dev`, is automated to identify potential vulnerabilities – not just in the code itself, but also in how it's configured and if any secrets are exposed due to this update. The key here isn't a manual audit, but leveraging GitHub's built-in scanning capabilities; options A & C represent misunderstandings of the process, while option D is reckless given the known vulnerability.
7 / 25
PR Description:
"Implemented a new feature to handle user profile updates. Updated the backend API endpoint using Express and added unit tests. No significant security changes were intended."This scenario highlights the importance of proactively addressing security concerns during development. Even when a PR doesn't explicitly detail vulnerabilities, developers should always consider potential risks associated with changes to APIs or backend logic. A good PR description should encourage reviewers to identify and address these issues – this is about fostering a culture of secure coding practices, not relying on explicit instructions.
8 / 25
Liam in the daily standup update said, "We've just merged a PR that uses the new GraphQL endpoint for retrieving user data. The team was eager to get this deployed quickly, but I'm concerned about potential injection vulnerabilities if we don't properly sanitize the input before sending it to the API. Should we immediately run a dependency scan and request a secret scan of the GraphQL client library?This scenario highlights the importance of layered security practices. While GraphQL itself has security considerations, relying solely on a dependency scan misses the potential for vulnerabilities within the client library's implementation or its interaction with the API. A secret scan is crucial to identify any exposed credentials or sensitive information that might be inadvertently included in the GraphQL queries or responses. Therefore, proactive scanning of both dependencies and secrets provides the most robust protection.
9 / 25
Mark is concerned about a common security issue: injection vulnerabilities. 'Insufficient input validation' describes the situation where the code doesn't adequately check and sanitize user-supplied data before using it in sensitive operations like database queries or API calls. This allows attackers to craft malicious inputs that could be interpreted as commands, leading to unauthorized access or data manipulation – this is a critical area for developers to address during security reviews. Option A describes an error handling issue, not the core vulnerability Mark identifies.
10 / 25
During a code review of a PR that adds a new API endpoint for retrieving product details, Emily notices the team is using an older version of the `axios` library. The project's security guidelines recommend keeping dependencies updated to mitigate known vulnerabilities. She asks: 'Should we initiate a dependency scan to check if this particular version of
axios has any reported issues?'The correct answer highlights the importance of proactive vulnerability management. Dependency scanning isn't just about fixing existing issues; it's a routine process that identifies and addresses potential risks before they become problems. Options A and C misrepresent the value of dependency scans, while option D focuses on a different security concern (secrets).
11 / 25
Sarah just submitted a Pull Request to update the authentication library in our project. During the code review, David comments: 'This PR introduces a dependency on `libsodium-dev`, which is known to have some recent vulnerabilities. I've flagged this for secret scanning – it's crucial we verify if any secrets are exposed.' Which of the following best describes David's action and concern?
David's action demonstrates proactive security practices within a code review. Secret scanning, particularly when triggered by a new dependency like `libsodium-dev`, is automated to identify potential vulnerabilities – not just in the code itself, but also in how it's configured and if any secrets are exposed due to this update. The key here isn't a manual audit, but leveraging GitHub's built-in scanning capabilities; options A & C represent misunderstandings of the process, while option D is reckless given the known vulnerability.
12 / 25
PR Description:
"Implemented a new feature to handle user profile updates. Updated the backend API endpoint using Express and added unit tests. No significant security changes were intended."This scenario highlights the importance of proactively addressing security concerns during development. Even when a PR doesn't explicitly detail vulnerabilities, developers should always consider potential risks associated with changes to APIs or backend logic. A good PR description should encourage reviewers to identify and address these issues – this is about fostering a culture of secure coding practices, not relying on explicit instructions.
13 / 25
Liam in the daily standup update said, "We've just merged a PR that uses the new GraphQL endpoint for retrieving user data. The team was eager to get this deployed quickly, but I'm concerned about potential injection vulnerabilities if we don't properly sanitize the input before sending it to the API. Should we immediately run a dependency scan and request a secret scan of the GraphQL client library?This scenario highlights the importance of layered security practices. While GraphQL itself has security considerations, relying solely on a dependency scan misses the potential for vulnerabilities within the client library's implementation or its interaction with the API. A secret scan is crucial to identify any exposed credentials or sensitive information that might be inadvertently included in the GraphQL queries or responses. Therefore, proactive scanning of both dependencies and secrets provides the most robust protection.
14 / 25
Mark is concerned about a common security issue: injection vulnerabilities. 'Insufficient input validation' describes the situation where the code doesn't adequately check and sanitize user-supplied data before using it in sensitive operations like database queries or API calls. This allows attackers to craft malicious inputs that could be interpreted as commands, leading to unauthorized access or data manipulation – this is a critical area for developers to address during security reviews. Option A describes an error handling issue, not the core vulnerability Mark identifies.
15 / 25
During a code review of a PR that adds a new API endpoint for retrieving product details, Emily notices the team is using an older version of the `axios` library. The project's security guidelines recommend keeping dependencies updated to mitigate known vulnerabilities. She asks: 'Should we initiate a dependency scan to check if this particular version of
axios has any reported issues?'The correct answer highlights the importance of proactive vulnerability management. Dependency scanning isn't just about fixing existing issues; it's a routine process that identifies and addresses potential risks before they become problems. Options A and C misrepresent the value of dependency scans, while option D focuses on a different security concern (secrets).
16 / 25
Sarah just submitted a Pull Request to update the authentication library in our project. During the code review, David comments: 'This PR introduces a dependency on `libsodium-dev`, which is known to have some recent vulnerabilities. I've flagged this for secret scanning – it's crucial we verify if any secrets are exposed.' Which of the following best describes David's action and concern?
David's action demonstrates proactive security practices within a code review. Secret scanning, particularly when triggered by a new dependency like `libsodium-dev`, is automated to identify potential vulnerabilities – not just in the code itself, but also in how it's configured and if any secrets are exposed due to this update. The key here isn't a manual audit, but leveraging GitHub's built-in scanning capabilities; options A & C represent misunderstandings of the process, while option D is reckless given the known vulnerability.
17 / 25
PR Description:
"Implemented a new feature to handle user profile updates. Updated the backend API endpoint using Express and added unit tests. No significant security changes were intended."This scenario highlights the importance of proactively addressing security concerns during development. Even when a PR doesn't explicitly detail vulnerabilities, developers should always consider potential risks associated with changes to APIs or backend logic. A good PR description should encourage reviewers to identify and address these issues – this is about fostering a culture of secure coding practices, not relying on explicit instructions.
18 / 25
Liam in the daily standup update said, "We've just merged a PR that uses the new GraphQL endpoint for retrieving user data. The team was eager to get this deployed quickly, but I'm concerned about potential injection vulnerabilities if we don't properly sanitize the input before sending it to the API. Should we immediately run a dependency scan and request a secret scan of the GraphQL client library?This scenario highlights the importance of layered security practices. While GraphQL itself has security considerations, relying solely on a dependency scan misses the potential for vulnerabilities within the client library's implementation or its interaction with the API. A secret scan is crucial to identify any exposed credentials or sensitive information that might be inadvertently included in the GraphQL queries or responses. Therefore, proactive scanning of both dependencies and secrets provides the most robust protection.
19 / 25
Mark is concerned about a common security issue: injection vulnerabilities. 'Insufficient input validation' describes the situation where the code doesn't adequately check and sanitize user-supplied data before using it in sensitive operations like database queries or API calls. This allows attackers to craft malicious inputs that could be interpreted as commands, leading to unauthorized access or data manipulation – this is a critical area for developers to address during security reviews. Option A describes an error handling issue, not the core vulnerability Mark identifies.
20 / 25
During a code review of a PR that adds a new API endpoint for retrieving product details, Emily notices the team is using an older version of the `axios` library. The project's security guidelines recommend keeping dependencies updated to mitigate known vulnerabilities. She asks: 'Should we initiate a dependency scan to check if this particular version of
axios has any reported issues?'The correct answer highlights the importance of proactive vulnerability management. Dependency scanning isn't just about fixing existing issues; it's a routine process that identifies and addresses potential risks before they become problems. Options A and C misrepresent the value of dependency scans, while option D focuses on a different security concern (secrets).
21 / 25
Sarah just submitted a Pull Request to update the authentication library in our project. During the code review, David comments: 'This PR introduces a dependency on `libsodium-dev`, which is known to have some recent vulnerabilities. I've flagged this for secret scanning – it's crucial we verify if any secrets are exposed.' Which of the following best describes David's action and concern?
David's action demonstrates proactive security practices within a code review. Secret scanning, particularly when triggered by a new dependency like `libsodium-dev`, is automated to identify potential vulnerabilities – not just in the code itself, but also in how it's configured and if any secrets are exposed due to this update. The key here isn't a manual audit, but leveraging GitHub's built-in scanning capabilities; options A & C represent misunderstandings of the process, while option D is reckless given the known vulnerability.
22 / 25
PR Description:
"Implemented a new feature to handle user profile updates. Updated the backend API endpoint using Express and added unit tests. No significant security changes were intended."This scenario highlights the importance of proactively addressing security concerns during development. Even when a PR doesn't explicitly detail vulnerabilities, developers should always consider potential risks associated with changes to APIs or backend logic. A good PR description should encourage reviewers to identify and address these issues – this is about fostering a culture of secure coding practices, not relying on explicit instructions.
23 / 25
Liam in the daily standup update said, "We've just merged a PR that uses the new GraphQL endpoint for retrieving user data. The team was eager to get this deployed quickly, but I'm concerned about potential injection vulnerabilities if we don't properly sanitize the input before sending it to the API. Should we immediately run a dependency scan and request a secret scan of the GraphQL client library?This scenario highlights the importance of layered security practices. While GraphQL itself has security considerations, relying solely on a dependency scan misses the potential for vulnerabilities within the client library's implementation or its interaction with the API. A secret scan is crucial to identify any exposed credentials or sensitive information that might be inadvertently included in the GraphQL queries or responses. Therefore, proactive scanning of both dependencies and secrets provides the most robust protection.
24 / 25
Mark is concerned about a common security issue: injection vulnerabilities. 'Insufficient input validation' describes the situation where the code doesn't adequately check and sanitize user-supplied data before using it in sensitive operations like database queries or API calls. This allows attackers to craft malicious inputs that could be interpreted as commands, leading to unauthorized access or data manipulation – this is a critical area for developers to address during security reviews. Option A describes an error handling issue, not the core vulnerability Mark identifies.
25 / 25
During a code review of a PR that adds a new API endpoint for retrieving product details, Emily notices the team is using an older version of the `axios` library. The project's security guidelines recommend keeping dependencies updated to mitigate known vulnerabilities. She asks: 'Should we initiate a dependency scan to check if this particular version of
axios has any reported issues?'The correct answer highlights the importance of proactive vulnerability management. Dependency scanning isn't just about fixing existing issues; it's a routine process that identifies and addresses potential risks before they become problems. Options A and C misrepresent the value of dependency scans, while option D focuses on a different security concern (secrets).
Frequently Asked Questions
What will I practise in "GitHub Security Vocabulary"?
Practice vocabulary for GitHub security features including Dependabot, secret scanning, GHAS, code scanning alerts, and branch protection rules.
How many exercises are in this module?
This module has 25 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more GitHub Platform Language exercises?
Browse the full GitHub Platform Language hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.