GitHub Code Security and Secret Protection Guide (2026)

GitHub now sells two application security products for private repositories. Code Security contains CodeQL and dependency controls. Secret Protection contains secret scanning and push protection. Pick Secret Protection when leaked credentials are the main risk, Code Security when private code needs CodeQL, or both.

At a Glance

What	Detail
Products	Code Security; Secret Protection
SAST engine	Semantic CodeQL queries
Languages	12 languages plus GitHub Actions
Secret scanning	Repository content and history
Push protection	Pre-repository secret blocking
AI layer	CodeQL Copilot Autofix
Public repositories	Core security features free
Platform	Cloud and Enterprise Server
Dependabot	Separate Dependabot guide

• Code Security costs $30 per active committer each month, while Secret Protection costs $19.
• CodeQL treats code as data and uses semantic, query-based analysis.
• Language support covers C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions.
• Secret scanning covers commits, pull requests, issues, wikis, and the entire Git history.
• Push protection blocks recognized secrets before they reach the repository.
• Copilot Autofix suggests fixes for CodeQL alerts without requiring a separate Copilot subscription.
• Public repositories get code scanning, secret scanning, push protection, and Copilot Autofix for free.

What Does GitHub Advanced Security Include?

GitHub Advanced Security includes two separately purchasable products. GitHub Code Security provides code scanning and dependency controls; GitHub Secret Protection detects exposed credentials and can block supported secrets during a push. GitHub Team and Enterprise customers can buy either product or both.

Product	Price
GitHub Code Security	$30/active committer/month
GitHub Secret Protection	$19/active committer/month

• Code Security includes CodeQL scanning, Copilot Autofix, custom Dependabot triage, security campaigns, and the dependency review action.
• Secret Protection includes secret scanning, push protection, Copilot secret scanning, custom patterns, and push-protection bypass controls.

You pay for unique committers whose commits were pushed to a repository with the feature enabled in the last 90 days. There's no pre-purchased seat count, so you don't pay for contributors who are inactive.

How Does CodeQL Find Vulnerabilities?

CodeQL finds vulnerabilities by building a database of source-code relationships and running security queries against it. Queries can follow data between inputs, functions and sensitive operations, then report matching flaws as code scanning alerts.

CodeQL processes your codebase in three steps. It generates a structured database from your source code, capturing the relationships between variables, functions, calls, and data flows. It then runs a library of queries against that database.

Each query looks for a specific vulnerability class: SQL injection, path traversal, command injection, insecure deserialization, hardcoded credentials, and more. The results surface as code scanning alerts in your pull requests and in the Security tab, with the specific line of code and an explanation of what the query found.

CodeQL queries can follow data flow from an application input, across function calls and module boundaries, to a security-sensitive use. That capability does not guarantee fewer false positives in every repository. Run the query suite against representative code and measure which alerts survive your review process.

Which Languages Does CodeQL Support?

CodeQL covers C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. If your stack sits outside that list, notably PHP and Scala, CodeQL does not analyse it. Check GitHub’s separate AI Scan support or another scanner rather than assuming CodeQL covers every language.

Should You Use Default or Advanced CodeQL Setup?

Use CodeQL default setup for a quick start with GitHub-selected languages, query suites and scan triggers. Use advanced setup when you need a custom GitHub Actions workflow, different queries or more control over the build and analysis.

Advanced setup generates a customizable GitHub Actions workflow file. You get control over which queries run, what events trigger analysis, and how results are filtered. Advanced setup is worth the configuration cost if you need to run extended query suites, tune performance on large codebases, or exclude specific paths from analysis.

GitHub also offers AI Scan for supported languages and frameworks beyond CodeQL. AI Scan and agentic autofix consume Code Security AI Credits, including on public repositories. Check the included allowance and spending budget before enabling those features widely.

How Does Copilot Autofix Work?

GitHub says Copilot Autofix generates fix suggestions for CodeQL alerts directly in the pull request where the alert appears. When a code scanning alert fires, Autofix reads the alert, the surrounding code, and the query documentation, then proposes a code change and explains what it's fixing and why.

Autofix does not require a separate GitHub Copilot subscription, because it ships bundled with GitHub Code Security.

The same alert may produce a different suggestion on different runs, and complex vulnerabilities that require tracing across multiple files may produce no suggestion at all. Treat Autofix suggestions as a starting point, because the PR still needs human review before it merges.

Autofix supports C, C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, and Rust across a subset of the default and security-extended query suites.

What Does GitHub Secret Protection Detect?

GitHub Secret Protection detects supported credential patterns and generic secrets in repository history and collaboration content. Secret scanning produces alerts; push protection can stop supported secrets before they reach the repository.

The paid Secret Protection tier adds several capabilities the free tier doesn't include. Custom patterns let you define regexes for secrets specific to your organization. Validity checks verify whether a detected secret is still active against the issuing provider's API.

Copilot secret scanning extends detection to unstructured secrets that don't match a specific pattern but look like credentials based on context.

How Does GitHub Push Protection Work?

GitHub push protection blocks pushes containing supported secrets before they reach the remote repository. It does not prevent local commits, so a developer may still need to remove the secret from local history before pushing again.

When a developer pushes code that contains a recognized secret, the push fails with an explanation of what triggered the block. The developer then has three options: remove the secret and push clean code, mark it as a false positive with a documented reason, or mark it as test data.

Contributors with write access can bypass the block with a reason logged for review. Organizations can configure delegated bypass, letting specific people approve bypass requests from others.

Push protection covers command-line pushes, web editor commits, file uploads, and REST API requests, so the block applies regardless of how the developer is committing code.

How Does Dependabot Fit into GitHub Advanced Security?

Dependabot handles software composition analysis for GHAS. It watches your dependency graph, checks it against the GitHub Advisory Database, and opens automated fix PRs when a patched version is available.

GitHub Code Security adds custom auto-triage rules on top, letting you write policies that auto-snooze, auto-dismiss, or auto-remediate alerts based on conditions you define. The AI agent fix assignment feature, where you can assign a Dependabot alert to Copilot, Claude, or Codex to draft a fix PR, also requires GitHub Code Security along with a Copilot plan.

The Dependabot guide covers all three features (Alerts, Security Updates, Version Updates), alert triage, and the specific limits of advisory-database matching. If you're evaluating the Dependabot layer of this stack in any depth, read that guide alongside this one: Dependabot guide.

How Do You Enable GitHub Advanced Security?

Enable GitHub Advanced Security features from the repository’s Settings → Advanced Security page. Select the relevant paid product for private repositories, then configure code scanning, secret scanning and push protection. Organisation security configurations can apply settings across repositories.

For code scanning, default setup needs no configuration file. GitHub detects your languages, selects the query suites, and starts running. You'll see the first alerts appear on the next push or within the first pull request you open after enabling it.

Advanced setup generates a .github/workflows/codeql.yml file that you commit to the repository. Edit that file to control query suites, trigger events, and any path exclusions you need.

For secret scanning, enabling it in settings is enough to start scanning new content. The historical scan of your Git history runs in the background and surfaces older alerts separately from new ones.

What Does GitHub Advanced Security Miss?

GitHub Advanced Security does not replace testing of the running application, and each scanner has language and detection limits. CodeQL reads source rather than observing live requests, so runtime behaviour and business rules still need dedicated tests even when static analysis finds related flaws.

It also doesn't analyze code outside the languages it supports. If PHP or another unsupported language is part of your stack, CodeQL has no visibility there.

Secret scanning catches credential formats it recognizes. Novel credential types or custom internal tokens won't trigger alerts until you configure custom patterns. The validity check feature tells you whether a detected secret is still active, but it depends on the issuing provider's API responding to the check.

This guide covers security for GitHub repositories. Microsoft also offers GitHub Advanced Security for Azure DevOps as a separate integration. Repositories hosted only on GitLab or Bitbucket need a compatible scanner and reporting workflow.

Push protection and secret scanning also don't replace a supply-chain behavioral scanner. They catch credentials your team accidentally commits. They don't catch a malicious package that was published to npm with an install script that exfiltrates your environment variables. For that threat class, add something like Socket alongside this stack.

Which GitHub Security Features Are Free?

Public GitHub.com repositories can use code scanning, secret scanning and dependency review without an active-committer licence. Private repositories need the relevant paid product. Some newer AI features consume separate credits even on public repositories.

Feature	Free on public repos	Requires paid plan
CodeQL code scanning	Yes	Code Security
Copilot Autofix	Yes	Code Security
Secret scanning	Yes	Secret Protection
Push protection	Yes	Secret Protection
Validity checks	No	GitHub Secret Protection
Custom secret patterns	No	GitHub Secret Protection
Copilot secret scanning	No	GitHub Secret Protection
Custom Dependabot triage rules	No	GitHub Code Security
Dependabot agent assignment	No	Code Security plus Copilot
Dependency review action	Yes	GitHub Code Security

Everything on that free list works at no cost for public repositories. For private repositories, you pay per active committer for whichever products you enable.

How Much Does GitHub Advanced Security Cost?

GitHub Code Security lists $30 per active committer per month, and Secret Protection lists $19. Both therefore cost $49 per covered active committer, before additional AI usage. For five active committers, that is $150 for Code Security, $95 for Secret Protection or $245 for both.

At 50 active committers with both products enabled, the monthly bill is around $2,450. Compare that figure against a third-party SAST tool and a dedicated secret scanner. The native GitHub workflow still has value, but it stops being the cheapest option at some team size.

Who Should Use GitHub Advanced Security?

GitHub Advanced Security suits teams that want security findings and enforcement inside their existing GitHub workflow. Choose Code Security for code and dependency checks, Secret Protection for credential leaks, or both when both risks need coverage.

A three-person team with both products enabled would pay about $147 each month at public list prices. That buys the documented CodeQL, dependency, secret, and push-protection features for covered repositories. Compare the result with the team's actual active-committer count and any unsupported languages before calling it complete coverage.

If 40% of your code is in a language CodeQL doesn't support, you're paying for SAST coverage of 60% of the problem.

Secret Protection is the relevant standalone product when credential leaks are the primary risk: organizations that handle API keys for external services, internal tooling teams that issue short-lived tokens, or any context where a leaked credential could affect customers.

Push protection at $19 per committer is a concrete cost to address that category of incident. It can only block secrets that match supported or custom patterns, and an authorised user may be able to bypass the block.

Frequently Asked Questions

Is GitHub Advanced Security free for public repositories?

GitHub.com public repositories can use code scanning, secret scanning, dependency review and standard Copilot Autofix without buying private-repository licences. AI Scan and agentic autofix use separate Code Security AI Credits, so public visibility does not make every AI feature free.

What is the difference between GitHub Code Security and Secret Protection?

GitHub Code Security covers CodeQL, Copilot Autofix, dependency review, and premium Dependabot controls. GitHub Secret Protection covers secret scanning, push protection, validity checks, generic secrets, and organization controls around bypasses.

How does GitHub count an active committer?

A GitHub committer counts when one of their commits was pushed to a repository with the paid product enabled during the previous 90 days, regardless of who performed the push. GitHub counts that person once across covered repositories in the organization or enterprise.

Can GitHub Advanced Security replace Socket or Snyk?

GitHub Advanced Security can replace overlapping checks from Socket or Snyk only if it covers your required repositories and risks. Socket adds package-behaviour and install-time controls; Snyk offers separate source, dependency, container and infrastructure scans. Compare those specific jobs before retiring either tool.

Does Copilot Autofix require a separate Copilot subscription?

Copilot Autofix for CodeQL alerts is included with GitHub Code Security and is free for public repositories. Assigning a Dependabot alert to a coding agent is a different feature and requires GitHub Code Security plus a Copilot plan with coding-agent access.

Verdict

Choose Code Security when GitHub-hosted repositories need CodeQL, dependency review, and related repository controls. Choose Secret Protection when credential detection and blocking are the priority. The products can be licensed separately, so the threat model should decide whether a private repository needs one or both.

CodeQL alerts can appear in pull requests and repository security views. That saves developers from opening another dashboard, but it does not tell you whether the alerts are accurate or easy to fix. During a trial, check which alerts are valid, how long fixes take, and whether the team uses the results.

The documented gaps include runtime behavior, unsupported languages, other hosting platforms, and package behavior outside advisory and dependency-review controls. Add a separate control only when the threat model names one of those gaps. For private repositories, the per-committer model lets a team license Secret Protection, Code Security, or both.

Related

• Application Security hub
• Dependabot guide
• Socket.dev supply chain guide
• AI code review hub

Next

• Application Security hub

Sources

• GitHub Advanced Security features
• GitHub licence and AI-credit billing

Facts and prices were checked against the official vendor pages on July 28, 2026.