GitHub / 2020–22
Several acquired security tools, each reporting problems its own way, turned into one product so developers can ship secure code.
- My part
- Principal Designer in the Security group, one of five designers, hands-on, with code scanning as my main surface and time for Actions, Code Search and the Primer design system.
- What shipped
- Code scanning, generally available in September 2020. In the month before launch, by GitHub’s count, developers fixed 72% of the security errors it reported in their pull requests before merging.
Whatever finds a problem, the developer should see it in the same form. The alert above is that form: state, severity, where it is, and what has happened to it since. CodeQL's data-flow paths were the one thing that didn't fit, so they went behind “Show paths” and the shape could stay the same for secret scanning and dependency alerts. The alternatives, each tool keeping the interface it came with or a security dashboard beside the repository, were prototyped and tested, internally and with some users, before this one won.
A repository can make code scanning a required check, so a finding blocks the merge. That is only bearable because an alert can be dismissed with a reason. Dismissal came second, as a consequence of blocking, and it should have come first.
Outside Security
Design System
GitHub had a large team dedicated to its design system, Primer. It started as CSS only, and the team then built React and Rails components on top of it. I worked with it from the product side: asking for changes to some of the components, and reviewing the proposals for new rules before they were adopted.
