GitHub Advanced Security
Native GitHub appsec stack: CodeQL code scanning, secret scanning with push protection, and dependency review.
Technical Architecture & Overview
GitHub Advanced Security bundles code scanning with the CodeQL engine, secret scanning with push protection and AI-detection of unstructured secrets, and dependency review plus Dependabot alerts, all inside GitHub workflows. GHAS is now sold as two products, GitHub Secret Protection and GitHub Code Security, priced per active committer, so feature allocation differs by subscription. GitHub Advanced Security is also sold as an add-on for Azure DevOps. Code scanning, Copilot Autofix, secret scanning, push protection, and dependency review are free on public repositories; AI-detected secrets and private repository use require the paid products.
Targeted Technical Use Cases
Teams already on GitHub that want appsec controls natively in pull requests without new tooling.
Evaluation & Trade-offs
Core Strengths
- +Findings surface inside repositories and pull requests without separate tooling.
- +CodeQL queries code as data for semantic analysis on supported languages.
- +Push protection blocks secrets before they land.
Trade-Offs & Limitations
- -Per-committer licensing costs grow with headcount.
- -Features split across two separately licensed products since April 2025, so coverage depends on the subscription.
Defensive Security Application
In-repo detection of vulnerable code, leaked secrets, and risky dependency changes.
Frequently Asked Questions
What is GitHub Advanced Security?→
GitHub Advanced Security bundles code scanning with the CodeQL engine, secret scanning with push protection and AI-detection of unstructured secrets, and dependency review plus Dependabot alerts, all inside GitHub workflows. GHAS is now sold as two products, GitHub Secret Protection and GitHub Code Security, priced per active committer, so feature allocation differs by subscription. GitHub Advanced Security is also sold as an add-on for Azure DevOps. Code scanning, Copilot Autofix, secret scanning, push protection, and dependency review are free on public repositories; AI-detected secrets and private repository use require the paid products.
What is GitHub Advanced Security used for?→
Teams already on GitHub that want appsec controls natively in pull requests without new tooling.
What are the strengths of GitHub Advanced Security?→
- +Findings surface inside repositories and pull requests without separate tooling.
- +CodeQL queries code as data for semantic analysis on supported languages.
- +Push protection blocks secrets before they land.
What are the limitations of GitHub Advanced Security?→
- +Per-committer licensing costs grow with headcount.
- +Features split across two separately licensed products since April 2025, so coverage depends on the subscription.
How is GitHub Advanced Security used defensively?→
In-repo detection of vulnerable code, leaked secrets, and risky dependency changes.