GHAS — Playbook

In a nutshell

GitHub Advanced Security (GHAS) is GitHub's paid security suite. It scans your repositories for two things developers leak by accident: credentials and vulnerable code.

It comes as two products you buy separately — Secret Protection and Code Security.

Why now

AI writes code faster than any review process was designed to absorb — and attackers reach the same models defenders do. Two curves moving in opposite directions.

4x+ increase in Dependabot alerts

New alerts created across GitHub, per quarter.

52M

Q1 25

70M

Q2 25

77M

Q3 25

82M

Q4 25

357M

Q1 26

313M

Q2 26

The 2025 baseline sat steadily around 70–80M, then jumped. CVE alerts platform-wide are up 6x since February 2026.

From vulnerability to exploitation

Mean gap between CVE public disclosure and first confirmed in-the-wild exploitation.

Based on 3,500+ confirmed-exploited CVEs (CISA KEV + VulnCheck KEV) · zerodayclock.com

What it means for AppSec

“Shift left” used to mean the IDE. Now the IDE, the CLI, the app, and the pull request blend into one continuous surface that agents move across freely. That has two consequences.

🌊 Traditional security can't keep up

The volume of new, AI-generated code outpaces what any traditional review process can inspect, and it arrives across many new surfaces at once. Gating at the pull request is already too late once an agent has propagated a change across repos.

⚡ Exploitation is faster than ever

Attackers reach the same frontier models, and cost is no object. They find and weaponize risk faster than defenders can triage it, and supply chain attacks move faster than any human review cycle.

How GHAS answers it

Scanning tools normally live outside the platform: a separate console, a separate backlog, and findings that reach the developer days after the code was written. GHAS puts all four steps where the code already is.

▸ CLICK A STEP FOR DETAILS

FIND

🔎 FIND — what is already there

Scans the full git history and every branch for leaked credentials, and builds a queryable database of the code to trace vulnerable data flows.

Runs across every repository in the org without asking a single team to install or configure anything.

PREVENT

🚧 PREVENT — before it lands

Push protection rejects the push carrying a secret, so it never reaches the remote and never needs rotating.

A ruleset can hold a pull request until code scanning comes back clean, so the gate is a repository rule rather than a reviewer remembering.

FIX

🔧 FIX — in the pull request

Alerts arrive as annotations on the diff, not as tickets in another tool the developer has to go open.

Copilot Autofix proposes an actual patch with an explanation, so the developer reviews a change instead of first researching the vulnerability class.

PROVE

📊 PROVE — across the enterprise

One security configuration applies to every org and repo, including ones created tomorrow.

Security overview reports which repos are covered, which are not, and how the backlog is trending, so coverage is a number rather than an assumption.

SELECT A STEP ▸

What’s inside 📖 Docs

Click a feature for details. Chips show free versus licensed.

Secret scanningSECRET PROTECTION · $19 Code scanningCODE SECURITY · $30 DependabotCODE SECURITY · $30

Secret scanningFREE ON PUBLIC

Scans the entire git history and every push against 200+ provider patterns. Validity checks confirm whether a leaked token is still live.

Push protectionFREE ON PUBLIC

Rejects the push carrying the secret, so it never reaches the remote and never needs rotating.

AI-detected secretsLICENSED ONLY

Catches unstructured credentials no regex describes: passwords in config, secrets in prose.

Custom patternsLICENSED ONLY

Your own token formats: internal services, legacy credentials, conventions no partner registers.

Delegated bypassLICENSED ONLY

Turns bypassing push protection into an approval request routed to a named reviewer group.

Public monitoringLICENSED ONLY

Enterprise, public preview. Detects secrets leaked in public repositories across GitHub, including repos you don't own. Attribution uses enterprise membership or verified domains. Requires Secret Protection or GHAS. Docs ↗

Code scanning (CodeQL)FREE ON PUBLIC

Compiles the code into a queryable database and traces data flow into dangerous sinks: injection, path traversal, deserialization.

Copilot AutofixFREE ON PUBLIC

Turns an alert into a suggested diff with an explanation on the pull request. This is what moves remediation rates.

AI-powered detectionsLICENSED ONLY

An AI engine covering languages and frameworks CodeQL has no queries for, during pull request review.

Third-party SARIFFREE ON PUBLIC

Any scanner emitting SARIF uploads into the same alert list: one backlog, one dashboard.

Security campaignsLICENSED ONLY

Slices the backlog into a finishable list with an owner and a due date, opened with the teams that own the code.

Dependency reviewFREE ON PUBLIC

A pull request check showing which dependencies the change adds, removes, or upgrades, blocking the merge on a known vulnerability.

Custom auto-triage rulesFREE ON PUBLIC

Your own rules to auto-dismiss or reopen Dependabot alerts at scale, so the backlog reflects real risk.

Security overviewLICENSED ONLY

Org-wide aggregation of supply chain risk and coverage, across every repository.

Other supply-chain featuresFREE ON ALL PLANS

Dependency graph, Dependabot alerts, security and version updates, malware alerts, preset auto-triage rules, and SBOM export are free on every plan.

Pricing 📖 Docs

Product	Price	Billing unit
🔑 GitHub Secret Protection	$19 / month	active committer
🔍 GitHub Code Security	$30 / month	active committer
📦 Both together	$49 / month	active committer

👥 Active committer = someone who pushed to a repo with the feature on in the past 90 days. Counted once across every repo and org; GitHub App bots don’t count
🏷️ Sold on GitHub Team and GitHub Enterprise. On Enterprise Server and GHE.com every repository needs a licence
🌐 Public repos get most features free, not all — custom patterns, delegated bypass, AI-detected secrets, campaigns and Security overview still need a licence (exact split ↗)

Pre-purchase inventory — Risk Assessments 📖 Docs

Two free assessments run from Org → Security → Assessments and show what is already hiding in your repos. No licence, no trial, and you see the numbers before deciding to buy.

🔑 Secret Risk Assessment

Types and count of secrets sitting in your org's repositories, aggregated by category.

SCOPE: All repos — public, private, internal, archived
RUNS: Once
OUTPUT: Counts only; secret values are never stored

🔍 Code Security Risk Assessment

Code vulnerabilities found by CodeQL, broken down by severity, language, and how many Copilot Autofix can fix.

SCOPE: Up to the 20 most active repos
RUNS: Once every 90 days
OUTPUT: Aggregated report; no Actions minutes consumed

🛂 Only organization owners and security managers can run them
🏷️ GitHub Team and GitHub Enterprise Cloud (Server support expected in 3.22)
🧪 You can start a GHAS trial directly from the results ↗, which is the natural next step once you have the numbers

Rolling out across the enterprise

One configuration at Enterprise → Settings → Advanced Security → Code security rolls out to every org and repo. New configuration opens pre-filled with GitHub recommended.

Block orgs that should not have itDo this firstDocs

Do thisEnterprise → Policies → Advanced Security → Policies tab → set the dropdown to Allow for selected organizations and keep only the orgs you want

Why firstDisallowing does not disable repos where it is already enabled. It only blocks additional repositories, so after rollout it is too late

Who it bindsRepository administrators only. Org owners and security managers can always enable it regardless of the policy

Push protection turns onblocks push onlyDocs

Blockedgit push, commits made in the GitHub UI, file uploads, REST API requests

Not blockedgit pull, git clone, git fetch. "Secret scanning will stop us pulling" is a misconception

Bypass is open to anyone with writedefault behaviorDocs

Defaultanyone with write access can bypass by picking a reason. Every bypass still leaves an alert, an audit log entry, and an email to owners

To restrictset Bypass privileges to Specific actors in the configuration (delegated bypass). Everyone else goes through a request and approval flow (requests expire after 7 days)

Code scanning runs on three triggersconsumes Actions minutesDocs

Whenevery push to the default or a protected branch, every PR creation and commit against those branches (fork PRs excluded), and a weekly schedule

Costthe dominant factor in an enterprise-wide rollout. Repos with no CodeQL-supported language use zero scans and zero minutes

Notecode scanning on its own never blocks a merge

Blocking merges needs a rulesetEnterprise → Policies → RulesetsDocs

WherePolicies → Repository → Rulesets → Require code scanning results

Blocks whenan alert at the configured severity, analysis running, or tool not configured

Trappoint it at repos without CodeQL and every PR is blocked even with zero alerts

What Evaluate isa dry run that records instead of blocking. Rule Insights shows what Active would have rejected. The others are Active and Disabled

Cover new repositoriesset via PolicyDocs

Do thisPolicy → Use as default for newly created repositories. Pick Enabled with advanced setup allowed for code scanning so existing CodeQL workflows survive

Scopenew repositories only. It does nothing to repositories that already exist

Cover existing repositoriesseparate Apply to actionDocs

Do thisfrom the configurations list, Apply to → All repositories without configurations

Enterprise onlyappears only at the enterprise level. Covers unconfigured repos without disturbing orgs that already have one

Scopearchived repos are included too, since secret scanning still runs on them

Pick specific repositoriesorganization configuration onlyDocs

Per repoenterprise Apply to offers only All repositories or All repositories without configurations. Choosing which repos get it is organization-level only

HowOrganization → Settings → Advanced Security → Configurations → Repositories tab → filter, select, Apply configuration

Who winsif an enterprise change conflicts with the org configuration the repo flips to removed_by_enterprise and the org config detaches. Enterprise wins

Visualizing coverage 📖 Docs

Once the configuration is out, the question becomes “how far are we actually covered?” The Security and quality tab answers it at both Enterprise and Organization level.

View	What it answers	Level
📊 Overview	Detection / remediation / prevention trends	Ent + Org
📈 Coverage	Which repos have which feature enabled	Ent + Org
🛡️ Risk	Which repos carry the most alerts	Ent + Org
🌐 Public monitoring	Secrets your members leaked in public repos across GitHub	Ent only

🏢 Org-level Coverage is the day-to-day view — enterprise views only aggregate orgs where you are an owner or security manager
🌐 Public monitoring (public preview, needs Secret Protection) attributes leaks by enterprise membership and verified domain. Turn it on at Enterprise → Settings → Advanced Security → Code security
📤 Export CSV on Overview / Coverage / Risk keeps the filters you already applied