Sessions

Explore the Universe 2025 on demand catalog. Filter by topic, audience, industry, format, or experience level.

Breakout session (40 minutes)

A focused presentation designed to inform and inspire the audience. These sessions typically feature a single speaker or co-presenters sharing expertise, insights, and practical takeaways. While this session type is primarily in a presentation format, audience engagement through Q&A, polls, and/or brief interactions is encouraged to enrich the experience.

Panel discussion (40 minutes)

A moderated session where a diverse group of experts debate or discuss fresh, timely, and thought-provoking topics shaping the industry. Panels should showcase a range of perspectives and experiences, challenging conventional wisdom and sparking new ideas. To ensure audience value, a significant portion of the session will be dedicated to Q&A and interactive engagement.

Fireside chat (40 minutes)

While similar to a panel discussion, this is a conversation between a moderator and one speaker rather than a group of experts.

Product demo (15 minutes)

A presentation focused on tips, tricks, and best practices for working in a specific product.

Discussions lounge (60 minutes)

A highly interactive gathering where two to three facilitators guides a group of 50+ attendees through dynamic small-group conversations on a specific topic of interest. Prioritizing active participation and collaboration, these discussion-driven sessions do not include slide presentations.

Sandbox session (60 mins)

This session combines both a demo-style and workshop format with practical exercises. Facilitators will demonstrate live the fundamental concepts, tools, or techniques they used to solve a specific challenge in the software development landscape. This will be followed by an opportunity for participants to actively engage in interactive exercises similar to the ones demonstrated to solidify their understanding.

Workshop (90 minutes)

Similar to a sandbox session (but without the demo portion), this session type focuses entirely on interactive exercises for a deeper, more immersive learning experience. This is your traditional workshop format, where facilitators guide attendees step-by-step through targeted activities. Participants will actively engage with the material, gaining practical insights and applying concepts in a collaborative setting tailored to enhance their understanding and skills. Note: Workshops require an additional fee of $99, which you can add to your registration in the Attendee Portal.

Level 100 – Introductory

Designed for those new to the topic, these sessions focus on foundational knowledge, covering basic concepts, features, and benefits. No prior expertise is assumed.

Level 200 – Intermediate

Best suited for attendees with a working understanding of the topic. These sessions explore real-world applications, technical details, and best practices.

Level 300 – Advanced

Intended for experienced practitioners, these sessions dive deep into complex, real-world challenges, advanced techniques, and expert-level insights.

In-person

Join us live at Universe for the full interactive experience with speakers and fellow attendees.

Recorded

Catch this session on-demand after the event—perfect for revisiting key insights or sharing with your team.

Livestream

Watch live from anywhere, then access the recording later. Get the real-time experience remotely.

On-demand

Available to watch anytime after Universe. Dive in when it fits your schedule.

AI summary

New this year: Get instant key takeaways with an AI-generated summary available shortly after the session ends.

Browse 2025 Sessions

32 sessions

10:00 am PDT - Oct 28

  • Workshop
    Build
    Secure
    Level 300: Advanced
    Applicable to All
    GitHub Copilot
    VS Code
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    Startups
    Educators & Students
    In-person
    AI (Agentic AI, Generative AI, Fine-tuned modeling, Models)
    Productivity
    IDE Integration
    Learn how to tailor GitHub Copilot’s suggestions using repository-specific instructions and prompt files to reflect your team’s coding standards, conventions, and architecture
    Gain insight into creating custom workflows that align Copilot with your security, compliance, and review processes — so it works the way your team does
    Understand how to scale Copilot customizations across your organization, enabling entire teams to benefit from shared context and consistent AI-assisted development
    Build faster, stay in flow
    What's new from GitHub?
    Developers
    All Approved and Published Sessions
    Tuesday, Oct 28
    10:00 a.m. Tuesday, Oct 28
    BuildIn-person
    Discover how to move from generic AI suggestions to a Copilot that fits your workflow like a glove. In this interactive workshop, we’ll guide you through setting up repository instructions, leveraging prompt files, and aligning Copilot with your security, style, and process requirements. Bring your use cases — we’ll help you design customizations that scale.

    , Principal Product Manager, Microsoft

    , Principal Solution Engineer, Microsoft

    , Sr. Cloud Solutions Architect, Microsoft

    See Details arrow-forward
    Track: Build, Secure
    Delivery Format: In-person
  • Product Demo
    Secure
    Level 300: Advanced
    Applicable to All
    GitHub Enterprise Cloud
    Enterprise - Engineering Leadership
    Security Professional
    Security Leadership
    In-person
    AI summary
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Productivity
    Platform engineering
    Governance and compliance
    Learn how to eliminate static credentials with short-lived SSH certificates to simplify access and reduce risk
    Discover how GitHub integrates with identity providers to issue secure, ephemeral access on demand
    Understand how to scale secure access across teams without manually rotating tokens or distributing keys
    Secure every commit
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    10:00 a.m. Tuesday, Oct 28
    SecureIn-person
    Static credentials like Secure Shell (SSH) keys and personal access tokens (PATs) can create hidden security risks and headaches for teams. But there’s a better way. In this session, you’ll learn how to move beyond static credentials by using short-lived, ephemeral SSH certificates. We’ll show you how GitHub, combined with your identity provider and a certificate-issuing service, can eliminate the need for long-lived tokens — making access simpler, safer, and more scalable. You'll gain practical insights on how to improve your security posture, streamline credential management, and give developers a smoother, more secure experience.

    , Senior Staff Engineer, Pure Storage

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Sandbox Session
    Secure
    Level 300: Advanced
    Financial Services
    Applicable to All
    Actions
    GitHub Advanced Security
    GitHub Copilot
    GitHub Code Security
    GitHub Enterprise Cloud
    GitHub Enterprise Server
    VS Code
    Enterprise - Engineering Leadership
    Security Professional
    Security Leadership
    In-person
    AI (Agentic AI, Generative AI, Fine-tuned modeling, Models)
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Tech debt and security debt
    Governance and compliance
    Learn how GitHub Copilot and CodeQL can help your enterprise proactively identify, inventory, and remediate insecure cryptography at scale without disrupting developer workflows
    Gain interactive experience using GitHub Copilot, CodeQL, and multi-repo variant analysis to detect and fix cryptographic vulnerabilities across large, complex enterprises and codebases.
    Discover how post-quantum cryptography preparation can be embedded into existing workflows, helping your organization meet future cryptographic compliance without slowing teams down.
    Secure every commit
    Security professionals
    Financial Services
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    10:00 a.m. Tuesday, Oct 28
    SecureIn-person
    Q-Day - the day quantum computers can break classic cryptography - is quickly approaching. In this session, we'll walk through that Y2K-like scenario, showing how CodeQL and GitHub Copilot can identify, analyze, and fix insecure cryptography at enterprise scale. We'll start by sharing why cryptographic security and post-quantum readiness should be on every organization's radar. Then, we'll dive into our cryptography security approach, powered by GitHub Copilot and CodeQL, and take you through an interactive enterprise demo on finding and fixing vulnerabilities. You’ll leave with practical insights and next steps to help your organization start securing its cryptography today.

    , Global Head of Cyber Security Research, Banco Santander

    , Principal Security Engineer, Microsoft

    , Staff CodeQL Analysis Engineer, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person

11:00 am PDT - Oct 28

  • Product Demo
    Build
    Secure
    Automate
    Level 100: Introductory
    Applicable to All
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    In-person
    Recorded
    AI summary
    Open source
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    For developers: How Immutable Releases help you trust the assets you consume in your projects
    For maintainers: How to use Immutable Releases to provide transparency and verifiability for your consumers, and reduce support burden related to asset integrity
    For the open source community: Learn how to streamline supply chain immutability, empower package managers, and enable broader, automated, and verifiable attestations for software assets
    https://youtu.be/5ifrlabINMQ
    Automate and scale with confidence
    What's new from GitHub?
    Open source
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases?utm_source=universe-web-page-docs-codesecurity&utm_medium=web&utm_campaign=universe25post
    Tuesday, Oct 28
    11:00 a.m. Tuesday, Oct 28
    BuildIn-person
    Tag mutability has long been a major pain point for maintainers and consumers alike. But with Immutable Releases, GitHub is introducing a way for maintainers to enforce the immutability of releases and provide cryptographically verifiable attestations for their assets. This session will cover an introductory-to-intermediate explanation and demo of Immutable Releases and illustrate how they can enable greater trust, transparency, and verifiability for everyone consuming release assets.

    , Staff Software Engineer, GitHub

    See Details arrow-forward
    Track: Build, Secure, Automate
    Delivery Format: In-person, Recorded, AI summary
  • Breakout Session
    Secure
    Automate
    Level 200: Intermediate
    Financial Services
    GitHub Advanced Security
    Enterprise - Engineering Leadership
    Security Professional
    Security Leadership
    In-person
    AI summary
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Threat Modeling
    Vulnerability Detection
    Learn deployment strategies for rolling out secret protection across thousands of repositories
    Discover automation patterns for prioritizing and remediating secrets at enterprise scale
    Understand how to "get clean" and build “stay clean” workflows that enforce guardrails without slowing developers down
    Secure every commit
    Security professionals
    Financial Services
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    11:00 a.m. Tuesday, Oct 28
    SecureIn-person
    Managing secrets is one of the most universal and pressing challenges in software security. In this session, Commonwealth Bank of Australia (CBA) and GitHub will share how they partnered to strengthen CBA’s security posture by implementing GitHub Secret Protection across thousands of repositories and developers. You’ll hear how they designed strategies for large-scale rollout, built “get clean” processes to effectively prioritize and remediate secrets, and established “stay clean” workflows that ensure secrets can’t be pushed into production—all without slowing developers down. Walk away with proven strategies and real-world lessons for implementing enterprise secret management that works, transforming a critical security challenge into a sustainable, developer-friendly practice.

    , Director of Software Engineering, GitHub

    , General Manager Engineering Platform, Commonwealth Bank of Australia

    , Executive Manager of Engineering, Commonwealth Bank of Australia

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person, AI summary

12:00 pm PDT - Oct 28

  • Breakout Session
    Secure
    Automate
    Level 300: Advanced
    Applicable to All
    GitHub Enterprise Cloud
    Security Professional
    Security Leadership
    In-person
    AI summary
    Tech debt and security debt
    Migration strategies
    Learn proven strategies for migrating thousands of developers to GitHub Enterprise Managed Users (EMU), integrating Azure AD, SCIM, and automated identity governance for maximum scale and security
    Walk away with a repeatable blueprint for streamlining access, cleaning up legacy permissions, and maintaining developer productivity during large-scale platform migrations
    Discover how automated access controls and audit-ready workflows dramatically reduce operational overhead, minimize risk, and improve compliance across your entire organization
    Automate and scale with confidence
    Engineering leaders
    Security professionals
    Financial Services
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    12:00 p.m. Tuesday, Oct 28
    SecureIn-person
    Learn how WEX migrated thousands of developers to GitHub Enterprise Managed Users (EMU), integrating Azure Active Directory, SCIM provisioning, and automated repository access management. During the session, you'll also discover how WEX minimized disruption while building a secure, automated foundation for developer productivity at scale, resulting in measurable time and cost savings, reduced manual support, and an improved security posture. The team will share hard-earned lessons on scaling identity, cleaning up legacy access, and creating audit-ready workflows that streamline compliance and reduce operational overhead.

    , Director Developer Enablement, WEX

    , Sr Staff Engineer, WEX

    , VP Platform Engineering, WEX

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person, AI summary
  • Workshop
    Secure
    Level 200: Intermediate
    Applicable to All
    Actions
    GitHub Advanced Security
    Dependabot
    GitHub Secret Protection
    GitHub Code Security
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Security Leadership
    In-person
    Agile practices
    DevOps and DevSecOps
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Tech debt and security debt
    Learn how to manage a risk-based rollout of GHAS across your organization
    Discover how to meet compliance requirements without slowing down your developers
    See how to satisfy frameworks like NIST SSDF, CRA, and SLSA in under two hours
    Secure every commit
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    12:00 p.m. Tuesday, Oct 28
    SecureIn-person
    Regulators, customers, and auditors are raising the bar on software security — and organizations need to prove they have the right controls in place, without slowing down innovation. In this interactive workshop, you’ll jump into action to help “Acme Corp” recover from a breach by rolling out GitHub Advanced Security (GHAS) using a risk-based approach. You’ll work inside a live GitHub Enterprise Cloud (GHEC) organization to classify repositories by risk, apply the right security configurations, and automate governance with organization-wide rulesets. You’ll also see how this practical playbook helps you meet compliance requirements for frameworks like NIST SSDF, CRA, and SLSA — all while keeping your developers moving fast and focused on what they do best: building great software.

    , Senior Service Delivery Engineer, GitHub

    , Senior Security Solution Architect, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person

2:00 pm PDT - Oct 28

  • Product Demo
    Secure
    Level 300: Advanced
    Applicable to All
    Actions
    GitHub Advanced Security
    GitHub Code Security
    GitHub Enterprise Cloud
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Startups
    Security Leadership
    Educators & Students
    In-person
    AI summary
    Automated Infrastructure Deployment
    Continuous Integration + Continuous Deployment (CI/CD)
    DevOps and DevSecOps
    Monitoring and observability
    Open source
    Shell programming (Bash, PowerShell, etc.)
    Tech debt and security debt
    Discover why efficient CodeQL scanning in monorepos requires strategic planning and organization of workflows
    See how using custom scripting and scan triggers can provide flexibility and precision in identifying vulnerabilities in monorepos
    Discover how to better manage security in your own monorepos — and improve overall software security without compromising performance
    Secure every commit
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    2:00 p.m. Tuesday, Oct 28
    SecureIn-person
    In this 15-minute demonstration, you'll learn how to secure monorepos at scale with GitHub Advanced Security (GHAS) and CodeQL. You'll see a live walkthrough of parallel analysis and language-specific CodeQL tuning for large repositories that accelerates workflow performance. By the end of the demo, you'll know how to configure CodeQL in a monorepo and apply targeted optimizations to streamline your security workflows.

    , Senior Principal Security Engineer, Modus Create

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Breakout Session
    Secure
    Level 200: Intermediate
    Computers & Electronics
    Financial Services
    Government
    Healthcare, Pharmaceuticals & Biotech
    Software & Internet
    Applicable to All
    Actions
    VS Code
    Enterprise - Developer
    Security Professional
    Security Leadership
    In-person
    AI summary
    AI (Agentic AI, Generative AI, Fine-tuned modeling, Models)
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Gain a clear understanding of the current security risks and conventions for authenticating and authorizing MCP servers
    Discover practical strategies and tools to simplify and strengthen security for both local and remote MCP servers
    Learn why security must be an integral part of the MCP server development lifecycle, and how familiar API security principles can be adapted for modern AI-powered infrastructures
    Secure every commit
    Agentic AI + Model Context Protocol (MCP)
    Developers
    Security professionals
    Financial Services
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    2:00 p.m. Tuesday, Oct 28
    SecureIn-person
    Model Context Protocol (MCP) is top of mind for developers. Everyone wants to expose tools and data to their customers' large language models (LLMs) in a consistent way. But can you do this without risking your data from being misused or accidentally exposed? In this session, you'll learn about the latest ways you can protect local and remote MCP servers and make sure that your data is secure — no matter how it's hosted.

    , Principal Product Engineer, Microsoft

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Workshop
    Secure
    Automate
    Level 300: Advanced
    Applicable to All
    Actions
    GitHub Advanced Security
    Dependabot
    GitHub Secret Protection
    GitHub Code Security
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    In-person
    Agile practices
    Continuous Integration + Continuous Deployment (CI/CD)
    DevOps and DevSecOps
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Governance and compliance
    Understand how to create a secure workflow with least privilege permissions
    Discover how to create zero-trust deployments that reduce or eliminate secrets
    Learn how to create guardrails for your processes and enforce separation of duties
    Automate and scale with confidence
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    2:00 p.m. Tuesday, Oct 28
    SecureIn-person
    From the Codecov Bash Uploader and IAmRoot exploits to compromised Actions, the threat landscape is evolving rapidly — as attackers increasingly target your CI/CD processes, not just your applications. In this workshop, you’ll learn how to design a secure, production‑ready CI/CD foundation on GitHub Actions that protects your pipeline and deploys without long‑lived secrets. You'll explore techniques for securing your supply chain, implementing least privilege, enforcing guardrails, and eliminating secrets from your deployments. Discover strategies used by top companies to build trust into their delivery pipelines and ship faster with less risk.

    , Senior Product Manager, GitHub

    , Senior DevOps Architect, GitHub

    , Staff DevOps Architect, ODST, GitHub

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person
  • Discussions Lounge
    Secure
    Level 100: Introductory
    Applicable to All
    GitHub Advanced Security
    GitHub Copilot
    Dependabot
    GitHub Secret Protection
    GitHub Code Security
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Security Professional
    Startups
    Security Leadership
    Educators & Students
    In-person
    Agile practices
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Tech debt and security debt
    Education
    Governance and compliance
    Discover innovative approaches to optimizing your security posture with the help of GitHub Advanced Security in an interactive group discussion
    Get a behind-the-scenes look at the role of a community security manager and why it matters in a shared responsibility model
    Take home security best practices from peers in your community — and share your own, too
    Secure every commit
    Security professionals
    Manufacturing
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    2:00 p.m. Tuesday, Oct 28
    SecureIn-person
    In a shared responsibility model, where both developers and security and IT teams share responsibility for security, GitHub Advanced Security (GHAS) plays a crucial role. But the other crucial role is that of the community manager, the person who fosters a culture of security and knowledge sharing, and who helps make sure that security measures are continuously improving. It's this combination of GHAS and a community manager that enables a holistic and robust security posture at an organization. And in this interactive group discussion, you're invited to bring your own best practices, challenges, and questions to the table — whether you're looking to enhance the technical aspects of your security strategy, the human ones, or both.

    , Community Security Manager, Otto GmbH &Co. KGaA

    , Senior Solutions Engineer, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person
  • Breakout Session
    Secure
    Automate
    Level 200: Intermediate
    Applicable to All
    GitHub Enterprise Cloud
    GitHub Enterprise Server
    Enterprise - Engineering Leadership
    Enterprise - Developer
    In-person
    AI summary
    DevOps and DevSecOps
    Collaboration
    Custom integrations and APIs
    Governance and compliance
    Discover practical strategies to save time, reduce manual effort, and scale security without sacrificing developer productivity
    See how smart, automated policies can enable least-privilege access and compliance, so your teams can focus on building and innovating, not managing permissions
    Get a sneak peek at upcoming GitHub enterprise innovations that will help you future-proof your platform and stay ahead of security challenges that could impede your progress
    Automate and scale with confidence
    What's new from GitHub?
    Engineering leaders
    Financial Services
    Manufacturing
    Healthcare & Life Sciences
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    https://docs.github.com/en/organizations?utm_source=universe-web-page-docs-organizations&utm_medium=web&utm_campaign=universe25post
    Tuesday, Oct 28
    2:00 p.m. Tuesday, Oct 28
    SecureIn-person
    Enterprise teams and admins are under pressure to balance robust security with developer productivity — especially as organizations scale to thousands of repositories and multiple business units. In this session, we’ll share proven strategies for transforming access management from a bottleneck into a business accelerator. Learn how leading platform teams leverage GitHub’s enterprise governance features to standardize policies, empower developers with just the access they need, and dramatically reduce risk — without slowing down innovation. Whether you’re looking to streamline onboarding, automate compliance, or support cross-functional teams, discover how to unlock developer velocity and security at scale.

    , Director of Product, Enterprise, GitHub

    , Staff Product Manager, GitHub

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person, AI summary

3:00 pm PDT - Oct 28

  • Product Demo
    Secure
    Level 200: Intermediate
    Applicable to All
    Actions
    Codespaces
    Dependabot
    GitHub Code Security
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    In-person
    AI summary
    Continuous Integration + Continuous Deployment (CI/CD)
    DevOps and DevSecOps
    Open source
    Collaboration
    Learn hot to set up Dependency Insights for Gradle projects hosted on GitHub using the Gradle Dependency-Submission Action
    Understand your build’s dependencies, including transitive dependencies, and any vulnerabilities present using GitHub Dependency Graph
    Learn how to use Gradle’s rich dependency management features to gain complete control over all your dependencies
    Secure every commit
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    3:00 p.m. Tuesday, Oct 28
    SecureIn-person
    In this demo, we’ll show you how GitHub and Gradle are working together to improve supply chain security. You’ll learn how to enable the Gradle dependency-submission GitHub Action for your project, which leverages the GitHub Dependency Submission API to report all resolved dependencies, not just those declared in your build files. This integration helps you and Dependabot identify and remediate vulnerabilities more efficiently at scale, which leads to more accurate security alerts, faster remediation, and a smoother workflow for securing your builds. Finally, we’ll explore how to use a Gradle Build Scan® and Develocity to discover even deeper insights.

    , Technical Documentation Lead, Gradle

    , Senior Software Developer, Gradle

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Breakout Session
    Secure
    Level 100: Introductory
    Applicable to All
    Enterprise - Engineering Leadership
    Open Source Developer or Maintainer
    Security Professional
    Security Leadership
    In-person
    AI summary
    AI (Agentic AI, Generative AI, Fine-tuned modeling, Models)
    Data (analytics, management, privacy)
    Open source
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Tech debt and security debt
    Governance and compliance
    Gain insight into how GitHub integrates advanced AI and ML systems to fortify defenses against threats, streamline abuse detection, and enhance user experiences without sacrificing speed or innovation
    Learn about the specific strategies and tools GitHub employs to detect and remediate malware
    Understand the importance of embedding safety and security into products, and how GitHub's Safety-by-Design Policy Framework ensure a secure and reliable platform for the global developer community
    Secure every commit
    Engineering leaders
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    3:00 p.m. Tuesday, Oct 28
    SecureIn-person
    GitHub is built on the power of community—helping developers stay productive while keeping the software ecosystem secure. As we integrate agentic AI across the platform, new safety challenges emerge. To support a growing, vibrant, and safe community, GitHub is investing in AI for safety and focusing on reducing malware. In this session, we’ll share how we’re tackling abuse, fraud, and online harms through strategies like malware detection, Safety-by-Design, and AI-powered protections. You’ll get an inside look at how we’re embedding safety into every layer of the platform to help keep developers and software secure.

    , Senior Director Safety & Integrity, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Product Demo
    Secure
    Level 200: Intermediate
    Applicable to All
    Actions
    GitHub Enterprise Cloud
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Security Professional
    Security Leadership
    In-person
    Recorded
    AI summary
    Cloud-native development
    Continuous Integration + Continuous Deployment (CI/CD)
    Containerized applications
    Kubernetes
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Governance and compliance
    GitHub Artifact Attestations makes it easy to start the process of securing your builds
    Write policies that ensure your builds came from your organization and used approved build workflows
    By starting policies in audit mode, you can bootstrap your way into your entire organization achieving compliance
    https://youtu.be/VeHMn9sRago
    Secure every commit
    What's new from GitHub?
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations?utm_source=universe-web-page-docs-actions&utm_medium=web&utm_campaign=universe25post
    Tuesday, Oct 28
    3:00 p.m. Tuesday, Oct 28
    SecureIn-person
    When it comes to securing your software supply chain, the build process is often the weakest link. That’s where GitHub Artifact Attestations comes in. With just one extra step in your GitHub Actions workflow, you can sign anything built in GitHub Actions — a file on disk or a container image. This signature includes verifiable links to your source code and build process, so you can write policies requiring all images come from your GitHub organization, or even a specific build workflow. Start small in audit mode to evaluate policy impact, then scale enforcement across your builds — with minimal configuration and clear traceability.

    , Principal Engineer, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, Recorded, AI summary

4:00 pm PDT - Oct 28

  • Product Demo
    Secure
    Level 200: Intermediate
    Computers & Electronics
    Software & Internet
    Applicable to All
    GitHub Secret Protection
    GitHub Enterprise Cloud
    Enterprise - Engineering Leadership
    Security Professional
    Security Leadership
    In-person
    AI summary
    DevOps and DevSecOps
    Git and code management techniques
    Productivity
    Platform engineering
    Custom integrations and APIs
    Governance and compliance
    Migration strategies
    Get inspired to protect and secure your most prized assets from attackers
    Gain insight into how Okta's team protected access while managing thousands of repos
    Discover how you can use GitHub to secure your source code without burdening your developers and administrative team
    Secure every commit
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Tuesday, Oct 28
    4:00 p.m. Tuesday, Oct 28
    SecureIn-person
    Say goodbye to the worries of long-lived access tokens! In this session, you'll discover how Okta's team swapped the security risk for a developer-friendly interface that offers time-limited repository access. Learn about their custom GitHub app and the CLI tool that made this security enhancement seamless.

    , Sr. Manager - Okta Developer Foundations, Okta

    , Staff Software Engineer, Okta

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary

11:00 am PDT - Oct 29

  • Product Demo
    Secure
    Level 200: Intermediate
    Applicable to All
    Dependabot
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Security Leadership
    In-person
    AI summary
    Tech debt and security debt
    Learn how to implement Dependabot's multi-signal prioritization approach to focus remediation efforts on vulnerabilities that pose the greatest risk to your organization
    Discover techniques for customizing Dependabot's settings to match your organization's security policies while reducing alert fatigue among developers
    Gain insight into how Dependabot's risk-based approach integrates with GitHub's security features to create a comprehensive vulnerability management system for your entire software supply chain
    Secure every commit
    What's new from GitHub?
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts?utm_source=universe-web-page-docs-billing&utm_medium=web&utm_campaign=universe25post
    11:00 a.m. Wednesday, Oct 29
    Wednesday, Oct 29
    SecureIn-person
    Want to stay ahead of security risks? Come learn about Dependabot's intelligent prioritization. This session will showcase how Dependabot leverages multiple risk signals — including artifact reachability context, custom repository metadata, severity and exploitability scores (CVSS/EPSS), Copilot context, and more — to surface the vulnerabilities that matter most. You'll discover how to focus your team's efforts where they'll have the greatest impact while keeping your software supply chain secure. There will also be a live demo and you'll leave with actionable tips to integrate intelligent prioritization seamlessly into your development pipeline.

    , Senior Product Manager, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Product Demo
    Secure
    Level 200: Intermediate
    Applicable to All
    GitHub Advanced Security
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Security Leadership
    In-person
    AI summary
    DevOps and DevSecOps
    Open source
    Tech debt and security debt
    Code quality, review, and completion
    Discover how to enable standardized code quality checking for your C and C++ code, to adapt to a world where code quality *is* security
    Discover how C and C++ application quality and security can be improved in a simple click-to-fix workflow with CodeQL coding standards and Copilot Autofix.
    Learn how to utilize your preference of the 1000+ security and quality rules implemented in the CodeQL Coding Standards project.
    Secure every commit
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    11:00 a.m. Wednesday, Oct 29
    Wednesday, Oct 29
    SecureIn-person
    CodeQL provides GitHub users and customers with scalable, on-demand static analysis via GitHub Code Security. For C and C++ developers, code quality and security are deeply intertwined. In this session, you'll learn how to enable additional CodeQL checks aligned with industry standards — including CERT, MISRA, and AUTOSAR — to improve safety, quality, and correctness in your codebases. We’ll walk through how to select from over 1,000 CodeQL queries, integrate them with GitHub Copilot Autofix and security campaigns, and apply them in a click-to-fix workflow that supports maintainable and secure development.

    , Senior CodeQL Analysis Engineer, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Product Demo
    Secure
    Level 100: Introductory
    Applicable to All
    Actions
    Dependabot
    GitHub Enterprise Cloud
    Projects and Issues
    Enterprise - Engineering Leadership
    Security Professional
    Security Leadership
    In-person
    AI summary
    DevOps and DevSecOps
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Migration strategies
    Yes
    Learn why automated backups and rapid recovery capabilities are essential for preventing data loss
    Discover how GitProtect’s cross-recovery and disaster recovery features can help you quickly recover from ransomware attacks or accidental deletions
    See how GitProtect works with GitHub Enterprise Server and SaaS, providing an easy-to-integrate solution that helps you meet compliance requirements and protect your development workflows from real-world threats
    Secure every commit
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    11:00 a.m. Wednesday, Oct 29
    Wednesday, Oct 29
    SecureIn-person
    Data loss from ransomware, accidental deletion, or other threats is a real risk for any organization. In this session, discover how GitProtect’s automated backup, rapid cross-recovery, and disaster recovery features safeguard your code and metadata — helping you meet compliance, minimize downtime, and ensure business continuity. See why every development leader needs a data loss prevention plan through a live demo of GitProtect’s integration with GitHub Enterprise Server and SaaS, and learn practical strategies to protect your repositories and your organization’s future.

    , Content Marketing Team Leader, GitProtect.io

    , Head of Product Enablement, GitProtect.io

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary

1:00 pm PDT - Oct 29

  • Breakout Session
    Build
    Secure
    Automate
    Level 200: Intermediate
    Applicable to All
    Actions
    GitHub Advanced Security
    GitHub Copilot
    Enterprise - Developer
    Open Source Developer or Maintainer
    Startups
    In-person
    AI summary
    AI (Agentic AI, Generative AI, Fine-tuned modeling, Models)
    Continuous Integration + Continuous Deployment (CI/CD)
    Platform engineering
    Learn how to migrate any legacy bash script with Copilot agent mode
    Discover how to secure your Actions workflows with GitHub Advanced Security
    Gain insights into GitHub Actions' advanced features, like matrix jobs and attestations
    Build faster, stay in flow
    What's new from GitHub?
    Developers
    All Approved and Published Sessions
    1:00 p.m. Wednesday, Oct 29
    Wednesday, Oct 29
    BuildIn-person
    Gather, heroes of coding! For too long ancient bash scripts haunted your repositories, lurking in the shadows of your CI/CD castles. Are you ready to venture in the Land of Automation? This session, directed in the form of an epic quest, will showcase best practices for building robust GitHub Actions workflows with strong supply chain security — empowering teams to modernize with automation and free developers from repetitive work. By leveraging GitHub Copilot, you'll discover how to fix execution errors, implement new pipeline jobs, and streamline your CI/CD, all while enhancing security with GitHub Advanced Security. This powerful combination of Copilot, GitHub Actions, and GitHub Advanced Security puts the developer experience front and center, transforming your automation workflows for today's fast-paced development landscape.

    , DevOps Consultant, Eficode

    , Solutions Engineer, GitHub

    See Details arrow-forward
    Track: Build, Secure, Automate
    Delivery Format: In-person, AI summary

2:00 pm PDT - Oct 29

  • Breakout Session
    Secure
    Level 200: Intermediate
    Applicable to All
    GitHub Advanced Security
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Startups
    Security Leadership
    Educators & Students
    In-person
    AI summary
    DevOps and DevSecOps
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Code quality, review, and completion
    Custom SAST rules transform scans into strategic tools for precise vulnerability detection
    Automated custom rules in your workflow catch issues early without slowing development
    Mastering rule customization boosts security, accelerates innovation, and provides strategic value
    Secure every commit
    Security professionals
    Manufacturing
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    2:00 p.m. Wednesday, Oct 29
    Wednesday, Oct 29
    SecureIn-person
    Static Application Security Testing (SAST) is often dismissed as just another code scanning tool — but when you take control, it can do so much more. In this session, GitHub and WirelessCar experts will show you how to go beyond the basics by customizing SAST rules to fit your applications and security priorities. You’ll learn why writing your own rules matters, how to do it effectively, and how to boost your results even further using targeted security campaigns. Walk away with practical tips to help you unlock deeper insights, strengthen your defenses, and take back control of your application security.

    , Security Architect, WirelessCar

    , Senior Application Security Executive, GitHub

    See Details arrow-forward
    Track: Secure
    Delivery Format: In-person, AI summary
  • Product Demo
    Secure
    Automate
    Level 200: Intermediate
    Applicable to All
    GitHub Copilot
    GitHub Code Security
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    In-person
    AI summary
    Productivity
    Tech debt and security debt
    Code quality, review, and completion
    Gain insight into how GitHub Code Quality simplifies technical debt management by helping teams identify and address issues
    Learn how to leverage automated fixes (via Copilot Autofix) to effortlessly improve code maintainability and reliability
    Understand how GitHub Code Quality integrates smoothly into workflows to save time and boost developer productivity
    Automate and scale with confidence
    What's new from GitHub?
    Security professionals
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    2:00 p.m. Wednesday, Oct 29
    Wednesday, Oct 29
    SecureIn-person
    Today’s developers face mounting technical debt, with leaders often struggling to understand the blockers that prevent teams from delivering faster. Traditional code quality tools promise solutions but often create overwhelming backlogs of unresolved issues. Enter GitHub Code Quality: a streamlined tool that helps users assess their code's health and take meaningful, automated actions without leaving their workflows (thanks to GitHub Copilot). Join this session to learn how Code Quality improves maintainability and reliability while saving your team valuable time.

    , Senior Product Manager, GitHub

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person, AI summary

3:00 pm PDT - Oct 29

  • Breakout Session
    Build
    Secure
    Level 100: Introductory
    Applicable to All
    GitHub Advanced Security
    Enterprise - Engineering Leadership
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Security Leadership
    In-person
    AI summary
    DevOps and DevSecOps
    Open source
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Governance and compliance
    How to interpret and understand licenses on a software project
    The open source licenses that you should be wary of using
    How to mitigate the business risk of using OSS in your organization
    Secure every commit
    Open source
    Developers
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-secure-large_1755504861206001HzrL.png
    All Approved and Published Sessions
    Wednesday, Oct 29
    3:00 p.m. Wednesday, Oct 29
    BuildIn-person
    These days, every codebase relies on open source software (OSS). From testing tools to utility libraries and whole frameworks, using OSS accelerates development velocity and lets you focus on the parts of your app that really matter. But every package you use comes with its own license, and some licenses can introduce compliance or legal risk in unexpected ways. What are licenses, how do they work, and how can you navigate the wild seas of OSS licensing to make the best use of open source, while still keeping your project compliant and secure? In this session, we'll talk through all of this and more.

    , Senior Product Manager, GitHub

    See Details arrow-forward
    Track: Build, Secure
    Delivery Format: In-person, AI summary
  • Product Demo
    Secure
    Automate
    Level 200: Intermediate
    Applicable to All
    Actions
    Enterprise - Developer
    Open Source Developer or Maintainer
    Security Professional
    Startups
    In-person
    AI summary
    Automated Infrastructure Deployment
    Continuous Integration + Continuous Deployment (CI/CD)
    DevOps and DevSecOps
    Security (RASP, supply chain, threat modeling, vulnerability detection)
    Platform engineering
    Yes
    Connect Actions jobs to private services using ephemeral, least‑privilege Tailscale access
    Enable hybrid and multi‑cloud testing without public exposure, VPN tunnels, or bastions
    Simplify pipelines by replacing brittle network plumbing with auditable, policy‑driven connectivity
    Automate and scale with confidence
    https://static.rainfocus.com/github/universe25/static/staticfile/staticfile/session-automate-large_1755504861317001HKfZ.png
    All Approved and Published Sessions
    Wednesday, Oct 29
    3:00 p.m. Wednesday, Oct 29
    SecureIn-person
    Discover how combining Tailscale’s secure networking with GitHub Actions opens up new possibilities for automation and CI/CD. In this session, you’ll explore how ephemeral, secure networks enable private service testing, multi-cloud deployments, and workflows that were previously impractical — or even impossible — without complex networking. You’ll also take home practical techniques for building faster, safer pipelines by bridging GitHub’s developer platform with Tailscale’s connectivity layer.

    , Director of Solutions Engineering, Tailscale

    See Details arrow-forward
    Track: Secure, Automate
    Delivery Format: In-person, AI summary