Skip to content

Commit 429a824

Browse files
docs-botdocs-bot
authored
Merge pull request #40192 from github/repo-sync
Repo sync
2 parents b7c040f + 76d2562 commit 429a824

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1758
-191
lines changed

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/calculating-the-cost-savings-of-push-protection.md

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
---
2+
title: Calculating the cost savings of push protection
3+
shortTitle: Push protection cost savings
4+
intro: Learn how to use the {% data variables.secret-scanning.roi-calculator %} to estimate the remediation time and labor costs you'll avoid by preventing leaked secrets.
5+
product: '{% data reusables.gated-features.secret-risk-assessment-calculators %}'
6+
versions:
7+
feature: secret-risk-assessment
8+
permissions: '{% data reusables.permissions.push-protection-roi-calculator %}'
9+
topics:
10+
- Secret scanning
11+
- Secret Protection
12+
contentType: how-tos
13+
---
14+
15+
## What is the cost savings calculator?
16+
17+
You can use the {% data variables.secret-scanning.roi-calculator %} to estimate the cost avoided by preventing leaked secrets with push protection. This information can help you:
18+
19+
* Determine how widely to enable {% data variables.product.prodname_GH_secret_protection %} in your organization.
20+
* Compare the estimated impact of push protection in different teams or environments.
21+
* Communicate time and cost implications of rollout decisions to stakeholders.
22+
23+
Push protection is a paid feature which is available with {% data variables.product.prodname_GH_secret_protection %}. For more information, see [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/choosing-github-secret-protection).
24+
25+
## Prerequisites
26+
27+
* You need to have generated a secret risk assessment for your organization. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization).
28+
* You have realistic values for:
29+
* Average remediation time per leaked secret (hours)
30+
* Average annual developer salary (USD)
31+
32+
## Estimating cost savings from push protection
33+
34+
{% data reusables.organizations.navigate-to-org %}
35+
{% data reusables.organizations.security-overview %}
36+
{% data reusables.security-overview.open-assessments-view %}
37+
1. On the top right corner of the banner, click **Get started**.
38+
1. In the dropdown, select **Estimate push protection savings**.
39+
1. Review the non-editable value for "Preventable leaks" (P). If 0, a baseline value (such as 70) is shown for modeling purposes.
40+
1. Enter or adjust the average developer annual compensation (C), in USD.
41+
* Use blended fully loaded annual compensation (salary + benefits).
42+
* Keep estimates conservative to avoid overstatement.
43+
1. Enter or adjust the time to remediate each leaked secret (T), in hours. We recommend you use an average remediation time that reflects steps for revoking, rotating, and validating secrets, as well as notifying your teams or customers:
44+
* T = 1-1.5 hours for simple rotation, minimal coordination
45+
* T = 2-3 hours to account for a distributed team or extra checks
46+
* T = 3-4 hours if you work in a regulated / audited environment
47+
1. Review the outputs from the **Return on investment** panel:
48+
* **Secrets prevented**: The number of preventable secrets detected.
49+
* **Time saved**: Total hours saved by preventing these secrets, based on your input.
50+
* **Potential savings with push protection**: The total estimated labor cost avoided.
51+
52+
{% note %}
53+
54+
Did you successfully use the {% data variables.secret-scanning.roi-calculator %} to estimate the cost savings of using push protection on your organization?
55+
56+
<a href="https://docs.github.io/success-test/yes.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>Yes</span></a> <a href="https://docs.github.io/success-test/no.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>No</span></a>
57+
58+
{% endnote %}
59+
60+
## Understanding your results
61+
62+
Next, review the results to understand their implications and determine the appropriate scope for rolling out push protection in your organization. Keep the following information in mind as you interpret your results.
63+
64+
The calculator **does**:
65+
* Estimate savings for **secrets blocked by push protection** only.
66+
* Base results on your risk assessment and assumptions you provide.
67+
* Provide estimates based on **labor cost avoidance** only.
68+
* Provide a modeled baseline for preventable leaks if no secrets were detected in the current scan window.
69+
70+
The calculator does **not**:
71+
* Include any costs related to data breaches or external impacts. For informational purposes, the cost of a data breach averaged $4.88M in 2024 according to IBM.
72+
* Include time savings from other {% data variables.product.prodname_GH_secret_protection %} features.
73+
* Support currencies other than USD.
74+
75+
## Troubleshooting
76+
77+
If you run into problems using the calculator, use the following table to troubleshoot.
78+
79+
| Issue | Action |
80+
|-------|--------|
81+
| **Preventable secrets = 0** | When no preventable secrets are detected, the calculator displays a default baseline value (such as 70) for modeling purposes.<br> To replace the baseline with real data, enable push protection on more repositories and allow secret scanning to collect more information. |
82+
| **Estimated savings shows $5M+** | The calculator is capped at $5M. If your modeled savings exceed this threshold, the value will be displayed as "$5M+" in the UI. To get the precise amount, export your input values (preventable secrets, time to remediate, and developer salary) and replicate the formula in a spreadsheet:</br>`(Secrets prevented) × (Time to remediate) × (Hourly rate)` where hourly rate is calculated as `Salary ÷ 2080`. |
83+
| **Value seems low** | Review your inputs for time to remediate and average developer compensation. Ensure you have included all steps involved in remediation (such as revoke, rotate, validate, and notify) and that the salary reflects a fully loaded annual cost. |
84+
| **Value seems high** | Double-check your input values for time to remediate and average compensation to make sure they are realistic and not overstated. Remove any outliers that could be skewing the estimate. |
85+
86+
## Further reading
87+
88+
* [Detecting and Preventing Secret Leaks in Code](https://github.com/resources/whitepapers/secret-scanning-a-key-to-your-cybersecurity-strategy) in {% data variables.product.github %}'s `resources` repository

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/choosing-github-secret-protection.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,14 @@ To generate a {% data variables.product.prodname_secret_risk_assessment %} repor
2727

2828
{% data variables.product.prodname_secret_protection %} is billed per active committer to the repositories where it is enabled. It is available to users with a {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} plan, see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security).
2929

30+
{% ifversion fpt or ghec or ghes > 3.19 %}
31+
32+
{% data variables.product.github %} provides two calculators to help you budget, justify rollout scope, and prioritize which repositories to enable {% data variables.product.prodname_secret_protection %} on first while optimizing license usage. You can estimate:
33+
* How much you can save by using push protection in repositories in your organization **with the {% data variables.secret-scanning.roi-calculator %}**. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/calculating-the-cost-savings-of-push-protection).
34+
* How much {% data variables.product.prodname_secret_protection %} will cost you monthly for repositories in your organization **with the {% data variables.secret-scanning.pricing-calculator %}**. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/estimating-the-price-of-secret-protection).
35+
36+
{% endif %}
37+
3038
## Why you should enable {% data variables.product.prodname_secret_protection %} for 100% of your organization's repositories
3139

3240
{% data variables.product.github %} recommends enabling {% data variables.product.prodname_GH_secret_protection %} products for all repositories, in order to protect your organization from the risk of secret leaks and exposures. {% data variables.product.prodname_GH_secret_protection %} is free to enable for public repositories, and available as a purchasable add-on for private and internal repositories.

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/estimating-the-price-of-secret-protection.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Estimating the price of Secret Protection
3+
shortTitle: Secret protection pricing
4+
intro: Learn how to use the {% data variables.secret-scanning.pricing-calculator %} to estimate the monthly cost of {% data variables.product.prodname_GH_secret_protection %} for your repositories.
5+
product: '{% data reusables.gated-features.secret-risk-assessment-calculators %}'
6+
versions:
7+
feature: secret-risk-assessment
8+
permissions: '{% data reusables.permissions.push-protection-roi-calculator %}'
9+
topics:
10+
- Secret scanning
11+
- Secret Protection
12+
contentType: how-tos
13+
---
14+
15+
## What is the pricing calculator?
16+
17+
You can use the {% data variables.secret-scanning.pricing-calculator %} on the secret risk assessment page to estimate the monthly cost of {% data variables.product.prodname_GH_secret_protection %} for your organization. This tool allows you to preview costs based on your current repositories and active committers, so you can plan for purchase or rollout decisions.
18+
19+
For more information about {% data variables.product.prodname_secret_protection %}, see [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/choosing-github-secret-protection).
20+
21+
## Prerequisites
22+
23+
You need to have generated a secret risk assessment for your organization. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization).
24+
25+
## Estimating the price of {% data variables.product.prodname_secret_protection %}
26+
27+
{% data reusables.organizations.navigate-to-org %}
28+
{% data reusables.organizations.security-overview %}
29+
{% data reusables.security-overview.open-assessments-view %}
30+
1. On the top right corner of the banner, click **Get started**.
31+
1. In the dropdown, select **Preview cost and enable Secret Protection**.
32+
1. In the calculator dialog, choose whether to estimate the cost for:
33+
* **All repositories**: Includes every repository in your organization.
34+
* **Selected repositories**: Choose specific repositories for the estimate.
35+
Once you've made your choices, the calculator shows:
36+
* The **estimated monthly cost** for your organization.
37+
* The **number of {% data variables.product.prodname_secret_protection %} licenses required**, based on active committers in the last 90 days for the selected repositories.
38+
* The **per-committer rate** (for example, $19 per active committer).
39+
1. To proceed with enabling {% data variables.product.prodname_secret_protection %}, click **Review and enable**.
40+
41+
{% note %}
42+
43+
Did you successfully use the {% data variables.secret-scanning.pricing-calculator %} to estimate the cost of using {% data variables.product.prodname_secret_protection %} features on your organization?
44+
45+
<a href="https://docs.github.io/success-test/yes.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>Yes</span></a> <a href="https://docs.github.io/success-test/no.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>No</span></a>
46+
47+
{% endnote %}
48+
49+
## Understanding your results
50+
51+
* **The {% data variables.secret-scanning.pricing-calculator %} only provides an estimate.** Actual billing is based on the number of active committers in the selected private repositories during the billing period.
52+
* The calculator **does not include costs for other {% data variables.product.prodname_GHAS %} features**.
53+
* The calculator **dynamically calculates active committers** for each repository you select. If two repositories share the same number of committers, adding the second repository shows 0 additional committers, because enabling {% data variables.product.prodname_secret_protection %} for one also covers the other. This helps you quickly see the true incremental cost as you select repositories.
54+
* USD is the only supported currency.

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,6 @@ children:
1515
- /viewing-the-secret-risk-assessment-report-for-your-organization
1616
- /interpreting-secret-risk-assessment-results
1717
- /choosing-github-secret-protection
18+
- /calculating-the-cost-savings-of-push-protection
19+
- /estimating-the-price-of-secret-protection
1820
---

‎content/copilot/how-tos/configure-custom-instructions/add-repository-instructions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -541,7 +541,7 @@ Your choice persists, for all repositories containing a custom instructions file
541541

542542
## Enabling and using prompt files
543543

544-
> [!NOTE] Prompt files are {% data variables.release-phases.public_preview %} and subject to change.
544+
{% data reusables.copilot.prompt-files-preview-note %}
545545

546546
Prompt files let you build and share reusable prompt instructions with additional context. A prompt file is a Markdown file, stored in your workspace, that mimics the existing format of writing prompts in {% data variables.copilot.copilot_chat_short %} (for example, `Rewrite #file:x.ts`). You can have multiple prompt files in your workspace, each of which defines a prompt for a different purpose.
547547

‎content/copilot/tutorials/customization-library/custom-instructions/accessibility-auditor.md

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
title: Accessibility auditor
3+
intro: 'Instructions for comprehensive web accessibility testing and compliance.'
4+
versions:
5+
feature: copilot
6+
category:
7+
- Custom instructions
8+
- Development workflows
9+
- Repository
10+
- Path-specific
11+
complexity:
12+
- Intermediate
13+
octicon: book
14+
topics:
15+
- Copilot
16+
contentType: tutorials
17+
---
18+
19+
{% data reusables.copilot.customization-examples-note %}
20+
21+
The following example shows a path-specific `accessibility.instructions.md` file that applies only to HTML files in your repository, and guides {% data variables.product.prodname_copilot %} to generate accessible, inclusive HTML that follows WCAG guidelines. For more information about path-specific instructions files, see [AUTOTITLE](/copilot/how-tos/configure-custom-instructions/add-repository-instructions#using-one-or-more-instructionsmd-files).
22+
23+
````text copy
24+
---
25+
applyTo: **/*.html
26+
---
27+
28+
When generating code, ensure accessibility compliance by following these priorities:
29+
30+
## Semantic HTML First
31+
- Use proper semantic elements: `<nav>`, `<main>`, `<section>`, `<article>`, `<header>`, `<footer>`
32+
- Structure headings sequentially (h1 → h2 → h3, never skip levels)
33+
- Use one `<h1>` per page with descriptive heading text
34+
35+
## Essential ARIA Requirements
36+
- Add `alt` text to all images
37+
- Label form inputs with `<label>` or `aria-label`
38+
- Ensure interactive elements have accessible names
39+
- Use `aria-expanded` for collapsible content
40+
- Add `role`, `aria-labelledby`, and `aria-describedby` when semantic HTML isn't sufficient
41+
42+
## Keyboard Navigation
43+
- All interactive elements must be keyboard accessible
44+
- Provide visible focus indicators (minimum 2px outline)
45+
- Include skip links: `<a href="#main">Skip to main content</a>`
46+
- Use logical tab order that matches visual layout
47+
48+
## Color and Contrast
49+
- Ensure 4.5:1 contrast ratio for normal text, 3:1 for large text
50+
- Don't rely solely on color to convey information
51+
52+
## Quick Test Questions
53+
- Can you navigate the entire interface using only Tab/Shift+Tab/Enter?
54+
- Are all images and icons properly described?
55+
- Can screen reader users understand the content and functionality?
56+
57+
## Screen Reader Compatibility
58+
59+
**Provide descriptive text for all non-text content:**
60+
- Images: Use alt text that describes function, not just appearance
61+
- Good: `alt="Submit form"`
62+
- Avoid: `alt="Blue button"`
63+
- Form inputs: Associate every input with a `<label>` element
64+
- Links: Use descriptive link text
65+
- Good: "Download the accessibility report (PDF, 2MB)"
66+
- Avoid: "Click here" or "Read more"
67+
68+
**Announce dynamic content updates:**
69+
- Use `aria-live="polite"` for status updates
70+
- Use `aria-live="assertive"` for urgent notifications
71+
- Update screen reader users when content changes without page reload
72+
73+
---
74+
75+
## Color and Contrast Requirements
76+
77+
**Meet these specific contrast ratios:**
78+
- Normal text (under 18pt): Minimum 4.5:1 contrast ratio
79+
- Large text (18pt+ or 14pt+ bold): Minimum 3:1 contrast ratio
80+
- UI components and graphics: Minimum 3:1 contrast ratio
81+
82+
**Provide multiple visual cues:**
83+
- Use color + icon + text for status indicators
84+
- Add patterns or textures to distinguish chart elements
85+
- Include text labels on graphs and data visualizations
86+
87+
---
88+
89+
## Testing Integration Steps
90+
91+
**Include these automated checks:**
92+
1. Run axe-core accessibility scanner in CI/CD pipeline
93+
2. Test with lighthouse accessibility audit
94+
3. Validate HTML markup for semantic correctness
95+
96+
**Perform these manual tests:**
97+
1. Navigate entire interface using only Tab and arrow keys
98+
2. Test with screen reader (NVDA on Windows, VoiceOver on Mac)
99+
3. Verify 200% zoom doesn't break layout or hide content
100+
4. Check color contrast with tools like WebAIM Color Contrast Checker
101+
102+
---
103+
104+
## Form Design Standards
105+
106+
**Create accessible form experiences:**
107+
- Place labels above or to the left of form fields
108+
- Group related fields with `<fieldset>` and `<legend>`
109+
- Display validation errors immediately after the field with `aria-describedby`
110+
- Use `aria-required="true"` for required fields
111+
- Provide clear instructions before users start filling out forms
112+
113+
**Error message format:**
114+
```html
115+
<input aria-describedby="email-error" aria-invalid="true">
116+
<div id="email-error">Please enter a valid email address</div>
117+
```
118+
119+
---
120+
121+
**Code Generation Rule:** Always include accessibility comments explaining ARIA attributes and semantic choices. Test code with keyboard navigation before suggesting it's complete.
122+
123+
````
124+
125+
{% data reusables.copilot.custom-instructions-further-reading %}

‎content/copilot/tutorials/customization-library/custom-instructions/code-reviewer.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: Code reviewer
3+
intro: 'Instructions for thorough and constructive code reviews.'
4+
versions:
5+
feature: copilot
6+
category:
7+
- Custom instructions
8+
- Team collaboration
9+
complexity:
10+
- Simple
11+
octicon: book
12+
topics:
13+
- Copilot
14+
contentType: tutorials
15+
---
16+
17+
{% data reusables.copilot.customization-examples-note %}
18+
19+
The following example shows custom instructions to guide {% data variables.product.prodname_copilot %} to provide thorough, constructive code reviews focused on security, performance, and code quality.
20+
21+
```markdown copy
22+
When reviewing code, focus on:
23+
24+
## Security Critical Issues
25+
- Check for hardcoded secrets, API keys, or credentials
26+
- Look for SQL injection and XSS vulnerabilities
27+
- Verify proper input validation and sanitization
28+
- Review authentication and authorization logic
29+
30+
## Performance Red Flags
31+
- Identify N+1 database query problems
32+
- Spot inefficient loops and algorithmic issues
33+
- Check for memory leaks and resource cleanup
34+
- Review caching opportunities for expensive operations
35+
36+
## Code Quality Essentials
37+
- Functions should be focused and appropriately sized
38+
- Use clear, descriptive naming conventions
39+
- Ensure proper error handling throughout
40+
41+
## Review Style
42+
- Be specific and actionable in feedback
43+
- Explain the "why" behind recommendations
44+
- Acknowledge good patterns when you see them
45+
- Ask clarifying questions when code intent is unclear
46+
47+
Always prioritize security vulnerabilities and performance issues that could impact users.
48+
49+
Always suggest changes to improve readability. For example, this suggestion seeks to make the code more readable and also makes the validation logic reusable and testable.
50+
51+
// Instead of:
52+
if (user.email && user.email.includes('@') && user.email.length > 5) {
53+
submitButton.enabled = true;
54+
} else {
55+
submitButton.enabled = false;
56+
}
57+
58+
// Consider:
59+
function isValidEmail(email) {
60+
return email && email.includes('@') && email.length > 5;
61+
}
62+
63+
submitButton.enabled = isValidEmail(user.email);
64+
```
65+
66+
{% data reusables.copilot.custom-instructions-further-reading %}

0 commit comments

Comments
 (0)