How Mercari uses GitHub

Mercari simplifies its security and CI/CD with GitHub Advanced Security and Actions.

Location: Tokyo, Japan
Industry: E-commerce, Fintech
GitHub Seats: 1,400 GitHub Enterprise, 800 GitHub Advanced Security

About Mercari

Since launching in 2013, Mercari has become a leading customer-to-customer shopping app for sellers cleaning out their closets and budget-conscious shoppers. The company continues to expand rapidly. In January 2021, Mercari launched Souzoh, a business-to-consumer business that includes Mercari Shops, enabling retailers to build their own e-commerce stores on the Mercari platform. The company also operates Merpay, a mobile payments platform accepted by more than 2.36M merchants and e-commerce sites in Japan.

Enabling collaboration across the enterprise

GitHub serves as one of the few tools that spans the entire Mercari enterprise, helping developers across the organization stay aligned and collaborate as the company grows. "Mercari has grown into a significant presence in both Japan and in the United States," says Souzoh Software Engineer Ryuzo Yamamoto. "This was only possible with GitHub."

GitHub makes it easy for Mercari's developers to share code internally through an innersource approach. When employees join, they have access to most repositories across the company, allowing any team to benefit from work other teams have already done or contribute improvements to code maintained by other parts of the organization.

Consolidating tooling and reducing overhead

Mercari is leveraging GitHub's ubiquity within the company to consolidate their tooling. "One of the big benefits of using GitHub for CI/CD and security automation is that we don't have to build, deploy, or maintain additional tools because they're built-in to GitHub," Yamamoto explains. "That means developers can spend less time managing tools and more time writing code, which is how they'd prefer to spend their time."

Shifting security left with GitHub Advanced Security

Mercari began using GitHub Advanced Security in June 2021 to strengthen their secret management processes. Previously, the company used an in-house secret scanning tool built with webhooks that would scan each code push and send Slack notifications to developers when secrets were detected.

"By switching to secret scanning as part of GitHub Advanced Security, we were able to avoid having to maintain and manage that software ourselves, and can insert the notifications directly into our developers' GitHub workflow," says Director of Product Security Nikolay Elenkov. "It's easier and faster to take action on an alert now, because there are fewer steps they need to take to view and fix an issue."

The company primarily uses Go for backend systems and TypeScript for frontend apps, along with a variety of other languages and frameworks. "We have numerous active repositories right now, so it is challenging to try and cover every single technology stack," Elenkov says. "CodeQL supports most of the languages we use."

Adopting GitHub Advanced Security has gone smoothly, with minimal false positives. When Mercari encountered a unique situation with fetching dependencies from private repositories during scanning, they partnered with GitHub Professional Services to find a solution.

Placing scanning into the developer workflow makes it more effective to fix issues, since developers can spot problems right away when their code is still fresh in their minds, rather than days, weeks, or months later. This also helps keep vulnerabilities and secrets out of production. "Alerting developers to the severity of specific issues helps get them resolved more quickly," Elenkov says. "Response times depend on the teams, but we have a culture that emphasizes fixing issues quickly."

GitHub Enterprise security tools are shifting security left for Mercari. "It's much cheaper to fix things in development than in production, so that's a big plus for us," Elenkov adds. "By spotting and fixing issues before they're deployed, we don't need to schedule a fix or worry about whether deploying a patch will cause problems in production."

Thanks to GitHub's ubiquity across Mercari, the company has enabled secret scanning for the entire organization. "Adopting code scanning across the org is definitely something that GitHub makes much easier. It would have been a struggle otherwise because integrating tools into everyone's workflow is complicated and time consuming," Elenkov says. "Having secret scanning and CodeQL baked into the GitHub platform makes things much, much easier for us."

Automating CI/CD with GitHub Actions

Mercari is using GitHub Actions to streamline workflows. The Souzoh team, for example, uses Actions as their primary CI/CD tool, automating everything from provisioning Go environments in the cloud to running tests and security scans. "We use quite a few Actions from the marketplace, but creating custom Actions is pretty easy," Yamamoto says. "There are plenty of examples and documentation to get started with."

Actions provides Mercari with the flexibility to customize solutions to fit their needs. "We do everything with self-hosted runners," Yamamoto explains. "We wanted to optimize the cache settings ourselves, and it helps us minimize secret sharing across environments."

Supporting growth in regulated industries

GitHub is also playing a role in solving Mercari's newest challenges as it expands into the highly regulated financial services space. "GitHub Professional Services is helping us with compliance, and our needs there are only going to grow," Yamamoto says.

"GitHub is like the air we breathe," Yamamoto concludes. "It's such a natural part of the way we work that sometimes we don't even notice it. We cannot imagine living without GitHub."