Postmates uses GitHub Advanced Security as a core part of its security program to keep its food delivery platform safe for customers, merchants, and couriers.

Security at Postmates is split into two main areas:

• Application Security (AppSec) – handles security reviews and runs the bug bounty program.
• Platform Security – focuses on network security policies and infrastructure protections.

Even though the security team is lean, they rely on automation to scale their impact. GitHub Advanced Security helps them:

• Automatically surface vulnerabilities in code before attackers can find them.
• Run CodeQL static analysis on every pull request and on a schedule, so new issues are caught before code is merged.
• Use Dependabot and secret scanning across every repository to detect vulnerable dependencies and exposed secrets.

Postmates delivers from more than 600,000 merchants across over 4,200 U.S. cities, so the security surface is large. By combining policy, automation, and GitHub’s tooling, they can keep their apps and supporting services locked down without slowing developers down.

Postmates evaluated several static analysis tools and ultimately chose CodeQL as part of GitHub Advanced Security because it better fit their technology stack and security goals.

Key reasons for choosing CodeQL:

• Language coverage that matched their stack – they needed support for Python, JavaScript, Java, TypeScript, and Go. Many tools they tried either didn’t support all of these or had gaps.
• Custom queries instead of a black box – earlier tools felt like black boxes: you ran them and hoped the results were useful. With CodeQL, the team can write their own queries, tune them to Postmates’ codebase, and continuously improve detection quality.
• Variant analysis – when a single issue is found (for example, via a third-party researcher), CodeQL helps them find variants of that same bug across multiple apps (buyer, merchant, courier) and services. It can track data from source to sink, which is especially useful for issues like cross-site scripting.

CodeQL also comes with an open source repository of thousands of queries that Postmates can use and extend. Over time, they’re building a robust, customized query set tailored to their own patterns and risks. This reimagines static analysis for them—from a one-off scan into a repeatable, automated practice that runs on every pull request and continuously across the codebase.

Postmates has built an automated pipeline that connects GitHub Advanced Security with their internal tracking and compliance tools, so security issues move smoothly from detection to remediation.

Here’s how the workflow looks:

• Detection in GitHub
  • CodeQL scans code on every push to the main branch and on a weekly schedule using GitHub Actions.
  • Dependabot is enabled on every repository to surface vulnerable open source dependencies and open automated pull requests.
  • Secret scanning runs across all repos to catch hard-coded credentials and other sensitive data.
• Aggregation and tracking
  • Using the GitHub API, they aggregate issues identified by CodeQL and other security features.
  • These findings are turned into Jira tickets for engineering teams to work on.
  • Tickets are also synced into ZenGRC, which manages compliance tasks and automatically pings developers.
• Prioritization and developer experience
  • They focus on low false positive rates so engineers aren’t overwhelmed with noise.
  • Easy fixes and “low-hanging fruit” are tackled alongside higher-priority vulnerabilities, even without a dedicated product manager.
  • Query results highlight patterns like hard-coded passwords or disabled certificate validation, which AppSec uses to coach teams on better practices.

Postmates also leans heavily on actively maintained open source. With Dependabot surfacing frequent updates, they accept that they’ll update dependencies often—but see it as a sign that vulnerabilities are being found and fixed instead of sitting unnoticed for years.

Overall, this automated approach helps Postmates shift security left, fit checks naturally into the development cycle, and free security engineers to focus on the harder bugs that require their expertise.