GitHub Advanced Security

GitHub Advanced Security (GHAS) is GitHub’s set of built-in security features. The main parts are:

Code scanning with CodeQL: static analysis that finds vulnerabilities in your code and workflows.
Secret scanning and push protection: finds secrets in the repository and blocks pushes that contain new ones.
Dependabot and the dependency graph: alerts and updates for vulnerable dependencies.

What we have

We’re on the GitHub Team plan, without the paid GitHub Code Security or Secret Protection add-ons. That means:

Feature	Public repositories	Private repositories
Dependabot alerts and updates	✅	✅
Dependency graph	✅	✅
Code scanning (CodeQL)	✅	❌
Secret scanning and push protection	✅	❌

Most of our repositories are private, so for those:

Dependabot is the main built-in tool. Set it up on every repository, see Dependabot.
Secrets must be caught some other way, see Secrets in private repositories below.
Workflows can be checked with zizmor, which doesn’t need GHAS.
Code gets no automated static analysis from GitHub. Rely on pull request review, and use an AI assistant security review as an extra pass on sensitive changes.

Everything that is available is managed from the Security tab and Settings → Advanced Security in each repository.

Secrets in private repositories

Without secret scanning, nothing on GitHub stops a secret from being pushed to a private repository. Run gitleaks instead:

Locally, before you push. Run gitleaks git in the repository, or set it up as a pre-commit hook so it runs on every commit.
In CI. Run the gitleaks CLI in a workflow. Note that the official gitleaks-action requires a paid license for organization repositories, while the CLI itself is free.

If a secret has been pushed, treat it as leaked and follow If a secret leaks.

Public repositories

On public repositories, everything is free. Enable all of it.

Secret scanning and push protection

Secret scanning finds credentials that have been committed to the repository, including in its history. Push protection blocks a push that contains a new secret before it reaches GitHub.

If push protection blocks your push, remove the secret from the commit instead of bypassing the block. Secret scanning only covers what’s in the repository. It won’t catch secrets that end up in build artifacts such as Docker images or client-side bundles.

Code scanning with CodeQL

CodeQL analyzes your code for common vulnerabilities such as injection, cross-site scripting and unsafe deserialization. It also scans GitHub Actions workflows for problems like the ones described in the GitHub guideline.

Use default setup: Settings → Advanced Security → Code scanning → CodeQL analysis → Set up → Default. GitHub detects the languages in the repository and runs the analysis on pushes, pull requests and a weekly schedule. No workflow file needed.

Only switch to advanced setup (a workflow file you maintain) if default setup doesn’t work for the repository, or you need to customize the analysis. See GitHub’s docs on configuring advanced setup.

To stop new findings from being merged, add a code scanning rule to the branch ruleset for the default branch. See code scanning merge protection.