Have you ever felt that fixing security vulnerabilities in your code is like finding a needle in a haystack? Well, you’re not alone.

In the world of software development, detecting secrets is just the beginning. The influx of alerts in their dashboard from various tools can be overwhelming for security teams. On average, companies with around 400 developers encounter about 1,500 secret incidents. The real challenge is narrowing these down and addressing them efficiently—a task many teams struggle with.

What if there was a way to make this process simpler and more effective?

GitGuardian’s latest feature updates are designed to complete your secrets remediation workflow and bring more efficiency to your team by helping you fix the code in less time.

Why is fixing the code and rotating the secrets so challenging?

In our journey, we’ve recognized that merely listing all occurrences of a secret often leaves AppSec teams and developers overwhelmed, especially in big enterprises. Sorting through extensive code with no clear focus can slow the remediation process. Additionally, incident managers frequently grapple with limited real-time visibility into the progress of fixes, making it hard to track improvements and ensure timely resolutions.

To tackle these challenges head-on, we’re excited to launch two powerful features designed to enhance your secrets remediation workflow:

Pinpointing Files Needing Code Fixes 

No more endless searches for code fixes. Our new “Require code fixing” tab pinpoints the exact files and lines of code on your default branches that need attention. Developers can now focus their efforts where needed most, saving time and increasing efficiency.

Occurrences requiring code fixes matter particularly as they are present in the current state of the code when browsing the SCM or when cloning the repository. Vulnerable files are listed in the "Require code fixing" section, with a link to the file in the SCM.

All occurrences are categorized by source (SCM, Slack, Jira, etc.) and some are isolated into the “Require code fixing” tab. This ensures that critical incidents needing attention are easily identifiable. The goal is for incident supervisors to resolve issues in the “Files requiring code fixing” tab before addressing the “All Occurrences” tab, which maintains historical data on all detected secrets occurrences, classified by source. This tab is for exhaustivity and auditability, it is not intended for performing actions beyond revocation.

Tired of wondering if code fixes are being implemented? Keeping tabs on the progress of incident fixes is now a breeze. With “remediation tracking,” incident managers can monitor the status of remediation pull requests in real time. This feature provides comprehensive and granular visibility into the secrets remediation process, ensuring comprehensive monitoring and streamlining collaboration.

The “Files pending merge” section tracks the code fixing progress by monitoring pull requests associated with each incident. It identifies pull requests that are set to address at least one mention of the secret. Once these pull requests are merged, they are then listed in the “Files fixed” section. You can click on the pull request names to view detailed information on the SCM website.

Incident managers can:

• Monitor the Progress: Track the level of remediation for each incident directly on the HEAD default branch.
• Check Remediation Status: Determine if a remediation request has been initiated for a file and verify if a pull request is specifically addressing the removal of the secret from the file, or if it is still awaiting validation to confirm that the secret has been effectively removed.
• View Pull Request Activity: See how many pull requests have already been addressed to remediate the incident.

By streamlining these steps, our new features will enhance your ability to manage and remediate secrets efficiently, ultimately leading to more secure and stable deployments.

Increased Developer Efficiency 

With our new features, occurrences are categorized and routed efficiently based on their nature. Incidents with occurrences requiring code fixes can be directed straight to developers. This targeted approach eliminates guesswork and enables quicker, more precise code correction by focusing on areas that need immediate code fixing.

Enhanced Collaboration 

For occurrences where no code fixes are required, the responsibility shifts to SREs or Ops teams to handle secrets rotation. Improved visibility and tracking fosters better communication between incident managers and both developers and SREs, facilitating a more coordinated and effective remediation process.

GitGuardian is committed to making secrets remediation as efficient and effective as possible. With these new features, we aim to empower your team with the tools they need to tackle secrets security issues swiftly and collaboratively. 

We’re not stopping here. Our plans include even more enhancements to streamline the remediation process, such as automated pull request workflows. Stay tuned for updates as we continue to innovate and improve the way you manage and remediate your secrets.

Ready to streamline your remediation workflow? 

You can access it by contacting us or your customer success manager (CSM). For more information, you can read the public documentation.

*** This is a Security Bloggers Network syndicated blog from GitGuardian Blog - Code Security for the DevOps generation authored by Soujanya Ain. Read the original post at: https://blog.gitguardian.com/fix-your-code-track-the-remediation/