Code Security Platform

GitHub Advanced Security

GitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.

$4/user/moLast verified 2026-09-06

Deployment

Cloud · Self-Hosted · Air-Gapped

Languages

12+

Pricing model

Per contributing developer, Usage-based credits

Free tier

Yes

Workflow coverage

Where in the development lifecycle GitHub Advanced Security operates.

Real-Time IDE FeedbackPartial

CodeQL results viewable through external SARIF viewers and IDE plugins; no first-party realtime IDE scanning documented

AI Agent Guardrail (MCP)No

Not offered in vendor documentation reviewed as of 2026-09-05.

Local CLI / Pre-CommitYesFree on public repos; add-on: Code Security for private/internal

CodeQL CLI creates and analyses databases locally or in any CI; push protection blocks at push time

PR Inline ReviewYesFree on public repos; add-on: Code Security for private/internal

Code scanning alerts, Copilot Autofix suggestions and github-code-quality[bot] comments on pull requests

Merge Gate BlockingYesAdd-on: Code Security (rulesets themselves are platform-level)

'Require code scanning results' and 'Require code quality results' rulesets; dependency review fail-on-severity

Full Repo ScanYesAdd-on: Secret Protection / Code Security (free on public repos)

Default-branch code scanning, secret scanning across full Git history of every branch, org-wide secret risk assessment

Scheduled / Continuous RescanYesFree (Dependabot); add-on: Code Security for private CodeQL

Default setup picks scan-triggering events, tool status page shows next scan time, Dependabot schedules configurable

Runtime / Production MonitoringNo

No runtime scanning; production/deployment context imported from Dynatrace, JFrog Artifactory, Microsoft Defender for Cloud

Analysis & detection

Every detection and code-analysis capability tracked for GitHub Advanced Security.

SASTYesFree on public repos; add-on: Code Security ($30/committer/mo) for private

CodeQL semantic analysis with default and security-extended query suites, plus an AI engine for uncovered languages

Taint / Data-Flow AnalysisYesFree on public repos; add-on: Code Security for private

CodeQL taint tracking; model packs add taint-flow models and threat models add taint sources, both public preview

Secrets DetectionYesFree on public repos (default patterns); add-on: Secret Protection ($19/committer/mo)

Provider, generic, AI-detected and custom patterns across full Git history; push protection blocks leaks

Secrets ValidationYesAdd-on: Secret Protection only (not on any free tier)

Validity checks confirm whether a detected secret is still active; also a credential revocation API

SCA (Dependencies)YesFree (all plans); enhanced with add-on: Code Security

Dependency graph plus Dependabot alerts from the GitHub Advisory Database with CVE/GHSA, CVSS, CWE data

Reachability AnalysisNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Malicious Package DetectionYesFree (all plans)

Dependabot malware alerts for malicious dependencies on GitHub.com and GitHub Enterprise Server 3.22+

License ComplianceYesFree on public repos; add-on: Code Security for private/internal

dependency review deny-licenses blocks disallowed licenses; open source license compliance policy across repos

SBOM GenerationYesFree (all plans)

SPDX-compatible SBOM export from the dependency graph via UI or REST API; linkable to artifact attestations

IaC ScanningPartialFree on public repos; add-on: Code Security for private

CodeQL scans GitHub Actions workflows; no Terraform, Kubernetes or CloudFormation IaC scanning documented

Container ScanningPartialFree (all plans)

Dependabot supports the docker ecosystem for updates; no container image vulnerability scanning documented

Cloud Posture (CSPM)No

Not offered in vendor documentation reviewed as of 2026-09-05.

DAST / API ScanningNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Code Smells & MaintainabilityYesCode Quality is not listed in any published plan or pricing table

GitHub Code Quality runs CodeQL quality queries for maintainability, reliability and style on PRs and default branch

Complexity MetricsNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Duplication DetectionNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Dead / Unused CodeNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Test Coverage TrackingNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Diff / New-Code CoverageNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Architecture GovernanceNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Technical Debt QuantificationPartialCode Quality pricing gating is not documented

Reliability and maintainability scores plus a default-branch findings backlog; no debt time or cost estimate

Behavioral Delivery AnalyticsNo

Not offered in vendor documentation reviewed as of 2026-09-05.

AI Logic Bug DetectionYesAdd-on: Copilot licences (separate from GHAS SKUs)

Code Quality AI findings reason about code intent; require Copilot licences and enterprise AI features enabled

PR Summaries & WalkthroughsPartialFree (dependency graph)

Manifest diffs render a rich dependency-change summary; no whole-PR summary or walkthrough documented

Custom Rule AuthoringYesAdd-on: Code Security and Secret Protection (free on public repos for CodeQL)

Custom CodeQL query suites and packs, model packs (preview), custom secret patterns, custom auto-triage rules

Autofix SuggestionsYesFree on public repos; add-on: Code Security for private

Copilot Autofix generates code fix plus explanation for CodeQL alerts; no Copilot subscription required

Autofix via Agentic PRsYesFree (Dependabot); add-on: Copilot licence + AI Credits for the agent

Dependabot security-update PRs; Copilot cloud agent pushes validated fixes (Copilot licence and AI Credits)

AI Triage / False-Positive FilteringYesFree (default rules); add-on: Code Security for custom rules

Dependabot default and custom auto-triage rules filter false positives; curated rules, not documented as AI

Monorepo SupportYesFree on public repos; add-on Code Security for private

category param documented for monorepo SARIF differentiation; matrix builds run per-component analysis in parallel

AI capabilities

AI Review EngineYesAdd-on: Code Security (source marks its plan gating 'implied'); Copilot licence for Code Quality AI findings

AI-powered security detections run at PR review for languages CodeQL misses; Code Quality adds LLM findings

BYO Model / BYOKNo

BYOK is scoped to Copilot Chat, CLI and IDEs; not documented for Autofix, Code Quality AI, or security detections

MCP ServerYesMCP server free; security toolsets require GHAS add-on

Official GitHub-maintained MCP server exposes code_security, secret_protection, dependabot toolsets; code scanning needs GHAS

AI Usage GovernanceNo

Enterprise/org policies govern whether Copilot Autofix and AI features may be used; no AI-code inventory

Chat With ReviewerYesAdd-on: Code Security (campaigns)

Copilot Chat answers vulnerability, fix and testing questions inside security campaigns; Copilot licensing unstated

Learns From FeedbackYes

Feedback on Copilot code-review comments improves later suggestions; no documented loop for Autofix or CodeQL

Code Excluded From TrainingYesCopilot Business or Copilot Enterprise plan

GitHub does not use Copilot Business or Enterprise customer data to train AI models; individual plans differ

Compliance & governance

Audit LogsYesEnterprise

Organization/enterprise audit log plus GraphQL Audit Log API for compliance monitoring and IP protection

SSO / SAMLNo

Not offered in vendor documentation reviewed as of 2026-09-05.

Role-Based Access ControlYesAdd-on: Secret Protection / Code Security plus platform roles

Security manager role, delegated push-protection bypass by user/role/team, runner groups, custom properties targeting

Compliance Reporting ExportsYesFree (SRA, SBOM); add-on for security overview insights

SARIF and CSV results export, SPDX SBOM export, secret risk assessment report, security overview, active-rules CSV

Standards mapping

SLSA Level 3 (artifact attestations)CWE (MITRE)CVEGHSACVSSEPSSSPDX (SBOM export)SARIFMicrosoft Responsible AI Standard (AI Application Card)OWASP Foundation (referenced as campaign remediation resource)

Integrations

GitHubYes
GitHub Enterprise ServerPartial
GitLabNo
GitLab Self-ManagedNo
BitbucketNo
Bitbucket Data CenterNo
Azure DevOpsNo
REST APIYes
CLIYes
WebhooksYes

CI/CD systems

GitHub Actions (primary delivery mechanism for default setup, advanced setup, dependency-review-action, Dependabot)Azure DevOps Pipelines (illustrated for CodeQL database creation via the CodeQL CLI)Any CI system via the CodeQL CLI plus codeql github upload-results or the code scanning REST API

Issue trackers

GitHub Issues (auto-created per repository by security campaigns)

Chat & notifications

Email (campaign updates and assignment notifications)

Pricing & plans

$19/active committer/month for GitHub Secret Protection (no annual discount published); GitHub Code Security $30/active committer/month; $49/active committer/month combined — both are add-ons on top of a required GitHub Team ($4/user/month) or Enterprise ($21/user/month) base plan

Minimum seats: None documented — metered and volume/subscription licensing both described with no stated seat minimum

Trial: 30 days, includes 50 licences and unlimited committers/organizations during the window; $0 except GitHub Actions minutes. Eligibility: enterprise account owners paying by card/PayPal, no prior GHAS purchase, not already on metered billing, at most one prior trial ended 180+ days ago; invoice customers request via sales.

GitHub Free / Pro / Team (base plans, no GHAS add-on)not specified in sourceAny developer or organization not yet buying paid AppSec add-ons; open source projects on public repositories
  • Dependency graph, SBOM export, GitHub Advisory Database
  • Dependabot alerts, security updates, version updates, malware alerts, default auto-triage rules
  • Repository security advisories and repository rulesets
  • Secret scanning alerts for partners and push protection for users
  • On public repos only: CodeQL code scanning, CodeQL CLI, Copilot Autofix, dependency review, secret scanning default patterns, push protection
  • Free secret risk assessment report for GitHub Team and Enterprise organizations
  • No secret scanning, push protection or CodeQL code scanning on private/internal repositories
  • No validity checks, generic AI-detected patterns, custom patterns, bypass controls or scan history API
  • No security campaigns, custom auto-triage rules or security overview insights
  • Artifact attestations limited to public repos (private/internal needs Enterprise Cloud)
  • Security overview dashboard limited
GitHub Secret Protection (add-on)$19 USDOrganizations prioritizing prevention of credential and secret leaks across private code
  • Secret scanning for private/internal repositories
  • Push protection for private/internal repos, plus bypass controls and delegated bypass
  • Generic (AI-detected) patterns and custom patterns with the AI regex generator
  • Validity checks and Copilot secret scanning
  • Secret insights in security overview and scan history API
  • Requires a GitHub Team or Enterprise Cloud base plan (or GHES with an appropriate licence)
  • No CodeQL code scanning, Copilot Autofix, dependency review or security campaigns for code
  • Billed on active-committer activity; volume/subscription buyers must specify committer licence counts
GitHub Code Security (add-on)$30 USDOrganizations prioritizing vulnerability discovery and remediation before production
  • CodeQL code scanning for private/internal repositories
  • Copilot Autofix (no Copilot subscription required)
  • Third-party SARIF extensibility and contextual vulnerability intelligence
  • Security campaigns (up to 1,000 alerts each)
  • Dependency review action for private/internal repos, Dependabot custom auto-triage rules, grouped security updates
  • Code insights in security overview
  • Requires a GitHub Team or Enterprise Cloud base plan (or GHES with an appropriate licence)
  • No secret scanning or push protection for private repos (that is Secret Protection)
  • Copilot cloud agent remediation needs separate Copilot licences and AI Credits
  • Security campaigns capped at 1,000 alerts each
GitHub Advanced Security (both SKUs)$49 USD ($19 + $30), or contact sales for bundled/enterprise termsEnterprises wanting SAST, SCA and secret protection natively inside GitHub
  • Full union of Secret Protection and Code Security features
  • Enterprise/organization security configurations, policies and rulesets
  • Security overview across secrets, code scanning and Dependabot
  • Metered billing option instead of pre-purchased licences
  • Still requires a GitHub Team or Enterprise Cloud/Server base plan
  • GitHub-hosted repositories only
  • GHES feature availability varies by server version
GHAS free trial$0 (Actions minutes still billed)Enterprise account owners evaluating GHAS at scale before purchase
  • Both Secret Protection and Code Security enabled
  • Any number of committers and organizations during the trial
  • 50 licences included for cross-functional participation
  • Can transition to metered billing after an Enterprise Cloud trial
  • Expires after 30 days if no purchase
  • Card/PayPal-paying enterprise account owners only; invoice customers must go through sales
  • Not available if GHAS was previously purchased or is already metered
  • At most one prior trial, ended at least 180 days ago
  • GitHub Actions minutes are still charged

Who it's for

Notable strengths

  • Runs inside GitHub itself, so scanning, alerts, autofix and merge gates live in the same PR, ruleset and Actions surfaces developers already use
  • CodeQL scanning, CodeQL CLI, Copilot Autofix, secret scanning, push protection, dependency review and dependency graph are free on every public repository
  • Copilot Autofix, AI generic secret detection and the AI custom-pattern regex generator explicitly do not require a Copilot subscription
  • Third-party SARIF uploads land in the same code scanning alert, autofix and campaign workflow as CodeQL findings
  • Alert prioritization uses EPSS exploitability, direct vs transitive relationship, runtime vs development scope, alert age, plus deployment/internet-exposure context from Dynatrace, JFrog Artifactory and Microsoft Defender for Cloud
  • Security campaigns give structured backlog burn-down with campaign managers, auto-created tracking issues, due dates and Copilot agent bulk remediation

Notable limitations

  • Requires GitHub as the git provider: every capability is scoped to GitHub.com, GitHub Enterprise Cloud or GitHub Enterprise Server repositories, with no GitLab, Bitbucket or Azure Repos support (Azure DevOps appears only as a CI system running the CodeQL CLI, with results uploaded back into GitHub)
  • Private and internal repositories get almost no GHAS scanning without buying the add-ons: two separate per-active-committer SKUs ($19 Secret Protection, $30 Code Security) layered on a GitHub Team or Enterprise Cloud/Server plan whose cost is not stated
  • Capability gaps versus full AppSec suites: no DAST, no container image scanning, no cloud posture management, no dependency reachability analysis, and IaC coverage limited to GitHub Actions workflows
  • Agentic remediation and Code Quality AI findings need separate Copilot licences and consume GitHub AI Credits, unlike the included Copilot Autofix
  • GitHub Code Quality appears in no published pricing or plan-availability table, so its commercial gating is undetermined; security campaigns are capped at 1,000 alerts each and GHES features are version-gated (3.20+, 3.22+)
  • GitHub's documentation names no third-party compliance certifications for GHAS (no SOC 2, ISO 27001, FedRAMP, HIPAA), and reviewer-cited gaps include the lack of a centralized cross-project reporting dashboard and deployment complexity

Similar tools

Other Code Security Platform tools in the directory.

AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.

FAQ

When should you choose GitHub Advanced Security?

GitHub Advanced Security best fits Mid-market teams, Enterprise. Runs inside GitHub itself, so scanning, alerts, autofix and merge gates live in the same PR, ruleset and Actions surfaces developers already use

What languages does GitHub Advanced Security support?

GitHub Advanced Security supports 12+ languages and frameworks, including C/C++, C#, GitHub Actions workflows, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, and 2 more.

What does GitHub Advanced Security integrate with?

GitHub Advanced Security integrates with GitHub, GitHub Enterprise Server (partial) for source control, CI systems including GitHub Actions (primary delivery mechanism for default setup, advanced setup, dependency-review-action, Dependabot), Azure DevOps Pipelines (illustrated for CodeQL database creation via the CodeQL CLI), Any CI system via the CodeQL CLI plus codeql github upload-results or the code scanning REST API.

What tools are similar to GitHub Advanced Security?

Similar Code Security Platform tools tracked here include Aikido, Checkmarx One, Corgea, Semgrep.

What are GitHub Advanced Security's plans and pricing?

GitHub Advanced Security offers a free tier, with paid plans starting around $4/user/mo.

Visit the official GitHub Advanced Security website

Opens github.com in a new tab. Review Radar is not affiliated with GitHub.