How to Scan Your GitHub Repository for Security Vulnerabilities in 5 Minutes

This tutorial walks you through scanning your GitHub repository for security vulnerabilities. Total time: under 5 minutes.

• A GitHub account
• A repository with code (any language)
• That's it

1. Go to ShipReady.dev
2. Click "Get Started"
3. Click "Continue with GitHub"
4. Authorize the GitHub App

After authorization, you'll see your repositories:

1. Find the repository you want to scan
2. Click "Connect"
3. Wait for the green checkmark

1. Click "Scan Now" on your connected repository
2. Watch the progress indicator
3. Results appear when complete

• SQL injection patterns
• XSS vulnerabilities
• Hardcoded secrets
• Authentication issues
• Authorization problems
• Input validation gaps

Your scan results show:

Security Score

A 0-100 score based on:

• Number of vulnerabilities
• Severity distribution
• Code patterns

Findings by Severity

Individual Findings

Each finding includes:

• Title: What the issue is
• File: Where it's located
• Line: Exact line number
• Description: Why it's a problem
• Fix: How to resolve it

Let's fix a common issue: hardcoded secret.

The Finding

CRITICAL: Hardcoded API Key Detected
File: src/config/api.ts
Line: 5
const API_KEY = 'sk_live_abc123xyz789'

The Fix

1. Create environment variable:

# .env.local
API_KEY=sk_live_abc123xyz789

1. Update code:

// Before
const API_KEY = 'sk_live_abc123xyz789'
// After
const API_KEY = process.env.API_KEY

1. Add to .gitignore:

# .gitignore
.env.local

1. Commit the fix:

git add .gitignore src/config/api.ts
git commit -m "Move API key to environment variable"
git push

1. Re-scan: Click "Scan Again" to verify the fix

SQL Injection

// Vulnerable
const query = SELECT * FROM users WHERE id = ${userId}
// Fixed
const query = 'SELECT * FROM users WHERE id = $1'
await db.query(query, [userId])

Missing Authentication

// Vulnerable
app.get('/api/users', async (req, res) => {
  return db.users.findAll()
})
// Fixed
app.get('/api/users', authenticate, async (req, res) => {
  return db.users.findAll()
})

XSS Vulnerability

// Vulnerable
// Fixed
{userInput}
// Or if HTML needed:
import DOMPurify from 'dompurify'

Enable Automatic Scanning

1. Go to repository settings
2. Enable "Scan on Push"
3. Now every push triggers a scan

Set Up PR Checks

1. Enable "PR Security Check"
2. Configure blocking rules
3. PRs with critical issues won't merge

Explore Security Score

• Click on your score for breakdown
• Track improvement over time
• Compare across repositories

"No code found"

Your repository might be:

• Empty
• Only containing non-code files
• Using an unsupported language

"Scan taking too long"

Large repositories take longer. If over 5 minutes:

• Check repository size
• Contact support for large repos

"GitHub permission error"

Re-authorize the GitHub App:

1. Go to GitHub Settings
2. Applications → Authorized OAuth Apps
3. Revoke ShipReady
4. Re-connect from ShipReady dashboard

✓ Connected GitHub
✓ Selected repository
✓ Ran first scan
✓ Reviewed results
✓ Fixed first issue
------------------------------------
Total: Minutes to secure code

You've completed your first security scan. Your code is now safer than 90% of AI-generated applications.