GitHub Advanced Security
GitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.
Deployment
Cloud · Self-Hosted · Air-Gapped
Languages
12+
Pricing model
Per contributing developer, Usage-based credits
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle GitHub Advanced Security operates.
5 yes 1 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | CodeQL results viewable through external SARIF viewers and IDE plugins; no first-party realtime IDE scanning documented |
| AI Agent Guardrails | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Local Analysis (Pre-Commit) | Yes | CodeQL CLI creates and analyzes databases locally or in any CI; push protection blocks at push time |
| Inline PR Comments | Yes | Code scanning alerts, Copilot Autofix suggestions and github-code-quality[bot] comments on pull requests |
| Quality Gates (Merge Blocking) | Yes | 'Require code scanning results' and 'Require code quality results' rulesets; dependency review fail-on-severity |
| Full Repo Scan | Yes | Default-branch code scanning, secret scanning across full Git history of every branch, org-wide secret risk assessment |
| Scheduled Rescans | Yes | Default setup picks scan-triggering events, tool status page shows next scan time, Dependabot schedules configurable |
| Runtime Monitoring | No | No runtime scanning; production/deployment context imported from Dynatrace, JFrog Artifactory, Microsoft Defender for Cloud |
Security scanning
8 yes 2 partial 3 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | CodeQL semantic analysis with default and security-extended query suites, plus an AI engine for uncovered languages |
| Taint Analysis (Data-Flow) | Yes | CodeQL taint tracking; model packs add taint-flow models and threat models add taint sources, both public preview |
| Secrets Detection | Yes | Provider, generic, AI-detected and custom patterns across full Git history; push protection blocks leaks |
| Secrets Validation | Yes | Validity checks confirm whether a detected secret is still active; also a credential revocation API |
| SCA | Yes | Dependency graph plus Dependabot alerts from the GitHub Advisory Database with CVE/GHSA, CVSS, CWE data |
| Reachability Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Malicious Package Detection | Yes | Dependabot malware alerts for malicious dependencies on GitHub.com and GitHub Enterprise Server 3.22+ |
| License Compliance | Yes | dependency review deny-licenses blocks disallowed licenses; open source license compliance policy across repos |
| SBOM Generation | Yes | SPDX-compatible SBOM export from the dependency graph via UI or REST API; linkable to artifact attestations |
| IaC Scanning | Partial | CodeQL scans GitHub Actions workflows; no Terraform, Kubernetes or CloudFormation IaC scanning documented |
| Container Scanning | Partial | Dependabot supports the docker ecosystem for updates; no container image vulnerability scanning documented |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Code quality
1 yes 1 partial 7 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | GitHub Code Quality runs CodeQL quality queries for maintainability, reliability and style on PRs and default branch |
| Complexity Metrics | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Duplication Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Diff Coverage (New Code) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Architecture Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Technical Debt Quantification | Partial | Reliability and maintainability scores plus a default-branch findings backlog; no debt time or cost estimate |
| Behavioral Code Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI review & fixes
4 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Code Quality AI findings reason about code intent; require Copilot licenses and enterprise AI features enabled |
| PR Summaries & Walkthroughs | Partial | Manifest diffs render a rich dependency-change summary; no whole-PR summary or walkthrough documented |
| Autofix Suggestions | Yes | Copilot Autofix generates code fix plus explanation for CodeQL alerts; no Copilot subscription required |
| Autofix Pull Requests | Yes | Dependabot security-update PRs; Copilot cloud agent pushes validated fixes (Copilot license and AI Credits) |
| AI Triage (False-Positive Filtering) | Yes | Dependabot default and custom auto-triage rules filter false positives; curated rules, not documented as AI |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Custom CodeQL query suites and packs, model packs (preview), custom secret patterns, custom auto-triage rules |
| Monorepo Support | Yes | category param documented for monorepo SARIF differentiation; matrix builds run per-component analysis in parallel |
AI capabilities
5 yes 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | AI-powered security detections run at PR review for languages CodeQL misses; Code Quality adds LLM findings |
| Bring Your Own Model | No | BYOK is scoped to Copilot Chat, CLI and IDEs; not documented for Autofix, Code Quality AI, or security detections |
| MCP Server | Yes | Official GitHub-maintained MCP server exposes code_security, secret_protection, dependabot toolsets; code scanning needs GHAS |
| AI Code Governance | No | Enterprise/org policies govern whether Copilot Autofix and AI features may be used; no AI-code inventory |
| Conversational Review | Yes | Copilot Chat answers vulnerability, fix and testing questions inside security campaigns; Copilot licensing unstated |
| Learning From Feedback | Yes | Feedback on Copilot code-review comments improves later suggestions; no documented loop for Autofix or CodeQL |
| Code Excluded From Training | Yes | GitHub does not use Copilot Business or Enterprise customer data to train AI models; individual plans differ |
Compliance & governance
3 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Organization/enterprise audit log plus GraphQL Audit Log API for compliance monitoring and IP protection |
| SSO (SAML) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Role-Based Access Control | Yes | Security manager role, delegated push-protection bypass by user/role/team, runner groups, custom properties targeting |
| Compliance Reporting & Exports | Yes | SARIF and CSV results export, SPDX SBOM export, secret risk assessment report, security overview, active-rules CSV |
Standards mapping
SLSA Level 3 (artifact attestations)CWE (MITRE)CVEGHSACVSSEPSSSPDX (SBOM export)SARIFMicrosoft Responsible AI Standard (AI Application Card)OWASP Foundation (referenced as campaign remediation resource)
Integrations
4 yes 1 partial 5 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Partial |
| GitLab | No |
| GitLab Self-Managed | No |
| Bitbucket | No |
| Bitbucket Data Center | No |
| Azure DevOps | No |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub Actions (primary delivery mechanism for default setup, advanced setup, dependency-review-action, Dependabot)Azure DevOps Pipelines (illustrated for CodeQL database creation via the CodeQL CLI)Any CI system via the CodeQL CLI plus codeql github upload-results or the code scanning REST API
Issue trackers
GitHub Issues (auto-created per repository by security campaigns)
Chat & notifications
Email (campaign updates and assignment notifications)
Languages
Languages and frameworks named in GitHub Advanced Security's documentation.
C/C++C#GitHub Actions workflowsGoJavaKotlinJavaScriptTypeScriptPythonRubyRustSwift
Pricing & plans
$19/active committer/month for GitHub Secret Protection (no annual discount published); GitHub Code Security $30/active committer/month; $49/active committer/month combined — both are add-ons on top of a required GitHub Team ($4/user/month) or Enterprise ($21/user/month) base plan
Minimum seats: None documented — metered and volume/subscription licensing both described with no stated seat minimum
Trial: 30 days, includes 50 licenses and unlimited committers/organizations during the window; $0 except GitHub Actions minutes. Eligibility: enterprise account owners paying by card/PayPal, no prior GHAS purchase, not already on metered billing, at most one prior trial ended 180+ days ago; invoice customers request via sales.
GitHub Free / Pro / Team (base plans, no GHAS add-on)Base GitHub plan price onlyAny developer or organization not yet buying paid AppSec add-ons; open source projects on public repositories
- Dependency graph, SBOM export, GitHub Advisory Database
- Dependabot alerts, security updates, version updates, malware alerts, default auto-triage rules
- Repository security advisories and repository rulesets
- Secret scanning alerts for partners and push protection for users
- On public repos only: CodeQL code scanning, CodeQL CLI, Copilot Autofix, dependency review, secret scanning default patterns, push protection
- Free secret risk assessment report for GitHub Team and Enterprise organizations
- No secret scanning, push protection or CodeQL code scanning on private/internal repositories
- No validity checks, generic AI-detected patterns, custom patterns, bypass controls or scan history API
- No security campaigns, custom auto-triage rules or security overview insights
- Artifact attestations limited to public repos (private/internal needs Enterprise Cloud)
- Security overview dashboard limited
GitHub Secret Protection (add-on)$19 USDOrganizations prioritizing prevention of credential and secret leaks across private code
- Secret scanning for private/internal repositories
- Push protection for private/internal repos, plus bypass controls and delegated bypass
- Generic (AI-detected) patterns and custom patterns with the AI regex generator
- Validity checks and Copilot secret scanning
- Secret insights in security overview and scan history API
- Requires a GitHub Team or Enterprise Cloud base plan (or GHES with an appropriate license)
- No CodeQL code scanning, Copilot Autofix, dependency review or security campaigns for code
- Billed on active-committer activity; volume/subscription buyers must specify committer license counts
GitHub Code Security (add-on)$30 USDOrganizations prioritizing vulnerability discovery and remediation before production
- CodeQL code scanning for private/internal repositories
- Copilot Autofix (no Copilot subscription required)
- Third-party SARIF extensibility and contextual vulnerability intelligence
- Security campaigns (up to 1,000 alerts each)
- Dependency review action for private/internal repos, Dependabot custom auto-triage rules, grouped security updates
- Code insights in security overview
- Requires a GitHub Team or Enterprise Cloud base plan (or GHES with an appropriate license)
- No secret scanning or push protection for private repos (that is Secret Protection)
- Copilot cloud agent remediation needs separate Copilot licenses and AI Credits
- Security campaigns capped at 1,000 alerts each
GitHub Advanced Security (both SKUs)$49 USD ($19 + $30), or contact sales for bundled/enterprise termsEnterprises wanting SAST, SCA and secret protection natively inside GitHub
- Full union of Secret Protection and Code Security features
- Enterprise/organization security configurations, policies and rulesets
- Security overview across secrets, code scanning and Dependabot
- Metered billing option instead of pre-purchased licenses
- Still requires a GitHub Team or Enterprise Cloud/Server base plan
- GitHub-hosted repositories only
- GHES feature availability varies by server version
GHAS free trial$0 (Actions minutes still billed)Enterprise account owners evaluating GHAS at scale before purchase
- Both Secret Protection and Code Security enabled
- Any number of committers and organizations during the trial
- 50 licenses included for cross-functional participation
- Can transition to metered billing after an Enterprise Cloud trial
- Expires after 30 days if no purchase
- Card/PayPal-paying enterprise account owners only; invoice customers must go through sales
- Not available if GHAS was previously purchased or is already metered
- At most one prior trial, ended at least 180 days ago
- GitHub Actions minutes are still charged
Who it's for
Best for teams whose code lives on GitHub and who want security scanning where developers already work.
A good fit if
- Your code is on GitHub
- You want CodeQL, secret scanning and push protection in the same pull requests, rulesets and Actions
- You want Copilot Autofix without a Copilot subscription
Consider alternatives if
- Your code is on GitLab, Bitbucket or Azure DevOps
- You need DAST, container image scanning or dependency reachability
- You need private-repository scanning without buying the paid add-ons
Similar tools
Other Code Security Platform tools in the directory.
AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.VeracodeEnterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
FAQ
When should you choose GitHub Advanced Security?
GitHub Advanced Security is best for teams whose code lives on GitHub and who want security scanning where developers already work. It's a good fit if:
- Your code is on GitHub
- You want CodeQL, secret scanning and push protection in the same pull requests, rulesets and Actions
- You want Copilot Autofix without a Copilot subscription
Consider alternatives if:
- Your code is on GitLab, Bitbucket or Azure DevOps
- You need DAST, container image scanning or dependency reachability
- You need private-repository scanning without buying the paid add-ons
What languages does GitHub Advanced Security support?
GitHub Advanced Security supports 12+ languages and frameworks, including C/C++, C#, GitHub Actions workflows, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, and 2 more.
What does GitHub Advanced Security integrate with?
GitHub Advanced Security integrates with:
- Source control: GitHub and GitHub Enterprise Server (partial)
- CI systems: GitHub Actions and Azure Pipelines, plus others through its CLI or API
What tools are similar to GitHub Advanced Security?
Other code security platforms tracked here:
What are GitHub Advanced Security's plans and pricing?
GitHub Advanced Security has a free plan, and paid plans start at $19/active committer/mo.
Opens github.com in a new tab. Review Radar is not affiliated with GitHub.