GitHub Code Security and Secret Protection Guide (2026)

GitHub now sells two application-security products for private repositories. Code Security contains CodeQL and dependency controls. Secret Protection contains secret scanning and push protection. Both use active-committer billing and keep findings inside GitHub.

Product facts and public prices verified against official GitHub sources on July 28, 2026.

At a Glance

What	Detail
Products	Code Security; Secret Protection
SAST engine	Semantic CodeQL queries
Languages	12 languages plus GitHub Actions
Secret scanning	Repository content and history
Push protection	Pre-repository secret blocking
AI layer	CodeQL Copilot Autofix
Public repositories	Core security features free
Platform	Cloud and Enterprise Server
Dependabot	Separate Dependabot guide

• Code Security costs $30 per active committer each month, while Secret Protection costs $19.
• CodeQL treats code as data and uses semantic, query-based analysis.
• Language support covers C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions.
• Secret scanning covers commits, pull requests, issues, wikis, and the entire Git history.
• Push protection blocks recognized secrets before they reach the repository.
• Copilot Autofix suggests fixes for CodeQL alerts without requiring a separate Copilot subscription.
• Public repositories get code scanning, secret scanning, push protection, and Copilot Autofix for free.

The 2025 Split

GitHub's billing documentation records the April 1, 2025 split into two independently purchasable products.

You can now buy GitHub Code Security (the SAST and scanning layer) or GitHub Secret Protection (the credential-leak layer) separately, or both together. GitHub Team plan customers can purchase either product without upgrading to Enterprise. That matters because the old bundle required Enterprise, which priced the feature out of smaller teams.

Product	Price
GitHub Code Security	$30/active committer/month
GitHub Secret Protection	$19/active committer/month

• Code Security includes CodeQL scanning, Copilot Autofix, custom Dependabot triage, security campaigns, and the dependency review action.
• Secret Protection includes secret scanning, push protection, Copilot secret scanning, custom patterns, and push-protection bypass controls.

GitHub lists Code Security at $30 and Secret Protection at $19 per active committer each month. Its billing documentation defines active use across the previous 90 days.

Billing runs on a metered model: you pay for unique committers who have pushed to a repository with the feature enabled in the last 90 days. There's no pre-purchased seat count, so you don't pay for contributors who are inactive.

Code Scanning with CodeQL

GitHub describes CodeQL as a semantic code-analysis engine built into the platform. It creates a database from the code and runs queries over that representation.

CodeQL processes your codebase in three steps. It generates a structured database from your source code, capturing the relationships between variables, functions, calls, and data flows. It then runs a library of queries against that database.

Each query looks for a specific vulnerability class: SQL injection, path traversal, command injection, insecure deserialization, hardcoded credentials, and more. The results surface as code scanning alerts in your pull requests and in the Security tab, with the specific line of code and an explanation of what the query found.

CodeQL queries can follow data flow from an application input, across function calls and module boundaries, to a security-sensitive use. That is a documented capability, not proof that every repository will receive fewer false positives. Run the query suite against representative code and measure which alerts survive your review process.

Supported Languages

CodeQL covers C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. If your stack sits outside that list, notably PHP and Scala, CodeQL won't analyze it and you'll need a different SAST tool for that layer.

Default vs. Advanced Setup

Default setup works without any configuration file. GitHub detects the languages in your repository, selects the appropriate query suites, and triggers analysis on push and pull request events. For most teams, this is the right starting point.

Advanced setup generates a customizable GitHub Actions workflow file. You get control over which queries run, what events trigger analysis, and how results are filtered. Advanced setup is worth the configuration cost if you need to run extended query suites, tune performance on large codebases, or exclude specific paths from analysis.

Copilot Autofix

GitHub says Copilot Autofix generates fix suggestions for CodeQL alerts directly in the pull request where the alert appears. When a code scanning alert fires, Autofix reads the alert, the surrounding code, and the query documentation, then proposes a code change and explains what it's fixing and why.

Two things worth knowing before you rely on it. It does not require a separate GitHub Copilot subscription. Autofix ships bundled with GitHub Code Security.

It is also non-deterministic: the same alert may produce a different suggestion on different runs, and complex vulnerabilities that require tracing across multiple files may produce no suggestion at all. Treat Autofix suggestions as a starting point for the fix, not a final answer. The PR still needs human review before it merges.

Autofix supports C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, and Rust across a subset of the default and security-extended query suites.

Secret Protection

GitHub says secret scanning examines commits, plus the content of pull requests, issues, discussions, wikis, and your entire Git history. When it finds a pattern that matches a known credential format, it generates an alert in your Security tab with remediation guidance.

The paid Secret Protection tier adds several capabilities the free tier doesn't include. Custom patterns let you define regexes for secrets specific to your organization. Validity checks verify whether a detected secret is still active against the issuing provider's API.

Copilot secret scanning extends detection to unstructured secrets that don't match a specific pattern but look like credentials based on context.

Push Protection

Push protection intercepts the push at the moment it happens, before the secret reaches the repository. It blocks the push, not the creation of a local commit. A developer may already have the secret in local history and still needs to remove it before pushing again.

When a developer pushes code that contains a recognized secret, the push fails with an explanation of what triggered the block. The developer then has three options: remove the secret and push clean code, mark it as a false positive with a documented reason, or mark it as test data.

Contributors with write access can bypass the block with a reason logged for review. Organizations can configure delegated bypass, letting specific people approve bypass requests from others.

Push protection covers command-line pushes, web editor commits, file uploads, and REST API requests, so the block applies regardless of how the developer is committing code.

Dependabot's Role

Dependabot is the SCA layer of the GHAS stack: it watches your dependency graph, checks it against the GitHub Advisory Database, and opens automated fix PRs when a patched version is available.

GitHub Code Security adds custom auto-triage rules on top, letting you write policies that auto-snooze, auto-dismiss, or auto-remediate alerts based on conditions you define. The AI agent fix assignment feature, where you can assign a Dependabot alert to Copilot, Claude, or Codex to draft a fix PR, also requires GitHub Code Security along with a Copilot plan.

The Dependabot guide covers all three features (Alerts, Security Updates, Version Updates), alert triage, and the specific limits of advisory-database matching. If you're evaluating the Dependabot layer of this stack in any depth, read that guide alongside this one: Dependabot guide.

Setting It Up

Code scanning and secret scanning are enabled from the repository's Code Security settings page. For an organization, you can enable them across all repositories from the organization's security settings in one pass rather than repository by repository.

For code scanning, default setup needs no configuration file. GitHub detects your languages, selects the query suites, and starts running. You'll see the first alerts appear on the next push or within the first pull request you open after enabling it.

Advanced setup generates a .github/workflows/codeql.yml file that you commit to the repository. Edit that file to control query suites, trigger events, and any path exclusions you need.

For secret scanning, enabling it in settings is enough to start scanning new content. The historical scan of your Git history runs in the background and surfaces older alerts separately from new ones.

Limits and Noise

CodeQL has gaps worth naming. Semantic SAST operates on your source code, not on your running application, so it won't surface vulnerabilities that only become visible at runtime: race conditions, authentication bypass through specific request patterns, or business-logic flaws.

It also doesn't analyze code outside the languages it supports. If PHP or another unsupported language is part of your stack, CodeQL has no visibility there.

Secret scanning catches credential formats it recognizes. Novel credential types or custom internal tokens won't trigger alerts until you configure custom patterns. The validity check feature tells you whether a detected secret is still active, but it depends on the issuing provider's API responding to the check.

The largest limit is structural: this entire stack is GitHub-exclusive. If any of your repositories live on GitLab, Bitbucket, or a self-hosted platform, GHAS doesn't help there. Teams with mixed hosting environments need to evaluate per-platform tooling rather than treating GHAS as a complete answer.

Push protection and secret scanning also don't replace a supply-chain behavioral scanner. They catch credentials your team accidentally commits. They don't catch a malicious package that was published to npm with an install script that exfiltrates your environment variables. For that threat class, you need something like Socket running alongside this stack, not instead of it.

What's Free vs What Costs You

GitHub lists Code Security at $30 per active committer monthly and Secret Protection at $19. Private-repository buyers can license either product or both.

Feature	Free on public repos	Requires paid plan
CodeQL code scanning	Yes	Code Security
Copilot Autofix	Yes	Code Security
Secret scanning	Yes	Secret Protection
Push protection	Yes	Secret Protection
Validity checks	No	GitHub Secret Protection
Custom secret patterns	No	GitHub Secret Protection
Copilot secret scanning	No	GitHub Secret Protection
Custom Dependabot triage rules	No	GitHub Code Security
Dependabot agent assignment	No	Code Security plus Copilot
Dependency review action	No	GitHub Code Security

Everything on that free list works at no cost for public repositories. For private repositories, you pay per active committer for whichever products you enable.

$30 per Active Committer

A five-person team where all five committers are active pays $150/month for Code Security, $95/month for Secret Protection, or $245/month for both. A ten-person team lands at $300, $190, or $490. GitHub counts anyone who pushed to a covered repository in the last 90 days as an active committer.

At 50 active committers with both products enabled, the monthly bill is around $2,450. Compare that figure against a third-party SAST tool and a dedicated secret scanner. The native GitHub workflow still has value, but it stops being the cheapest option at some team size.

Who Should Use It

Teams already on GitHub can keep code-scanning and secret alerts in repository and organization security views. Default CodeQL setup avoids a hand-written workflow for supported languages, while advanced setup provides a customizable Actions workflow. Push protection is enforced by GitHub rather than by a developer-installed local scanner.

A three-person team with both products enabled would pay about $147 each month at public list prices. That buys the documented CodeQL, dependency, secret, and push-protection features for covered repositories. Compare the result with the team's actual active-committer count and any unsupported languages before calling it complete coverage.

Teams with mixed hosting environments, or those whose language stack includes unsupported languages, should evaluate whether the GitHub-only coverage matches their actual codebase before committing.

If 40% of your code is in a language CodeQL doesn't support, you're paying for SAST coverage of 60% of the problem.

Secret Protection is the relevant standalone product when credential leaks are the primary risk: organizations that handle API keys for external services, internal tooling teams that issue short-lived tokens, or any context where a leaked credential could affect customers.

Push protection at $19 per committer is a concrete cost to address that category of incident. It cannot prevent every secret format without supported or custom patterns, and an authorized bypass changes the enforcement result.

FAQ

Is GitHub Advanced Security free for public repositories?

Yes. Public repositories can use CodeQL code scanning, secret scanning, push protection, dependency review, and Copilot Autofix without buying the private-repository products. Paid licensing is required for the corresponding features in private or internal repositories.

What is the difference between GitHub Code Security and Secret Protection?

GitHub Code Security covers CodeQL, Copilot Autofix, dependency review, and premium Dependabot controls. GitHub Secret Protection covers secret scanning, push protection, validity checks, generic secrets, and organization controls around bypasses.

How does GitHub count an active committer?

A committer counts when they have pushed a commit to a repository with the paid product enabled during the previous 90 days. GitHub counts that person once across covered repositories in the organization or enterprise.

Does GitHub Advanced Security replace Socket or Snyk?

No. GitHub documents CodeQL analysis, secret protection, dependency advisories, and review controls. Socket adds package-behavior signals and supported install-time controls, while Snyk documents separate source, open-source, container, and infrastructure scanning products.

Does Copilot Autofix require a separate Copilot subscription?

Copilot Autofix for CodeQL alerts is included with GitHub Code Security and is free for public repositories. Assigning a Dependabot alert to a coding agent is a different feature and requires GitHub Code Security plus a Copilot plan with coding-agent access.

Verdict

Choose Code Security when GitHub-hosted repositories need CodeQL, dependency review, and related repository controls. Choose Secret Protection when credential detection and blocking are the priority. The products can be licensed separately, so the threat model should decide whether a private repository needs one or both.

CodeQL alerts can appear in pull requests and repository security views. That placement removes a separate finding portal, but it does not establish alert precision, remediation speed, or team adoption. Measure those outcomes during a representative trial.

The documented gaps include runtime behavior, unsupported languages, other hosting platforms, and package behavior outside advisory and dependency-review controls. Add a separate control only when the threat model names one of those gaps. For private repositories, the per-committer model lets a team license Secret Protection, Code Security, or both.

Related

• Application Security hub
• Dependabot guide
• Socket.dev supply chain guide
• AI code review hub

Next

• Application Security hub