Vendor Profile

GitHub Advanced Security

GitHub Advanced Security (GHAS) is a native security suite built into the GitHub platform that provides code scanning (SAST via CodeQL), secret scanning, dependency review, and Dependabot for automated dependency updates. By embedding security directly into the GitHub pull request workflow, GHAS provides a seamless experience for teams already using GitHub as their source code management platform. GHAS is included free for public repositories and available as a paid add-on for GitHub Enterprise customers.

Last updated February 28, 2026

Founded

2019

Pricing

Free for public repos / $49/committer/month for GitHub Enterprise

Verify with vendor

Deployment

CloudSelf-Hosted

Developer Security

Key Features

+CodeQL-based SAST with custom query support

+Secret scanning across repositories and push protection

+Dependency review and vulnerability alerts

+Dependabot automated dependency update PRs

+Security overview dashboard for organizations

+Pull request integration with inline annotations

+Custom CodeQL queries for organization-specific rules

+GitHub Actions workflow integration

Pros & Cons

Pros

+Zero-friction integration for GitHub-native development teams
+Free for all public repositories including SAST and secret scanning
+CodeQL provides deep semantic analysis with custom query capabilities
+Secret scanning with push protection prevents credential leaks proactively
+Dependabot automates dependency updates with minimal configuration

Cons

–Only available for GitHub repositories, creating platform lock-in
–No container image scanning beyond basic Dependabot alerts
–No IaC security scanning capabilities
–Per-committer pricing can be expensive for organizations with many contributors
–SCA capabilities are less comprehensive than Snyk's purpose-built analysis

Best For

Development teams already using GitHub that want native, zero-friction security scanning integrated directly into their pull request workflow

User Reviews

Takes about 2 minutes. Your review helps other security teams.

No reviews yet. Be the first to share your experience!