Feb 16
Loading video player...
🚀 **How LinkedIn Scales Security Without Breaking Developer Speed!** 🛡️💻 Ever wondered how a tech giant like **LinkedIn** manages to secure tens of thousands of repositories without slowing down its engineering teams? In this episode, we dive into LinkedIn’s massive redesign of its **Static Application Security Testing (SAST)** pipeline! LinkedIn has officially moved to a unified, **GitHub-native security pipeline** that leverages the power of **GitHub Actions**, **CodeQL**, and **Semgrep**. We’re breaking down the "shift-left" strategy that delivers actionable security feedback directly into pull requests, making life easier for developers while keeping members safe. **What’s inside this deep dive:** 🔹 **The Scalability Secret:** How LinkedIn uses a clever "stub workflow" design to propagate security updates across thousands of repos instantly. 🔹 **The Power Duo:** Why they chose CodeQL and Semgrep for their complementary strengths in code scanning. 🔹 **Reliability First:** The "kill switches" and safety mechanisms that ensure a scanner outage never blocks a critical merge. 🔹 **Enforcement at Scale:** Using GitHub repository rulesets to keep vulnerabilities out of production. Whether you're into **DevSecOps**, **Software Architecture**, or just love hearing how big tech solves "scale" problems, this is one you don't want to miss! 🎧✨ **Keywords:** DevSecOps, LinkedIn Engineering, GitHub Actions, CodeQL, Semgrep, AppSec, Static Analysis, Software Architecture, Shift Left Security. **Source Attribution:** Information based on the article "LinkedIn Leverages GitHub Actions, CodeQL, and Semgrep for Code Scanning" by Leela Kumili, originally published on **InfoQ**.