GitHub Advanced Security

GitHub Advanced Security adds code scanning, secret scanning and dependency review to repositories hosted on GitHub, running inside the platform where the code already lives rather than as a separate service the code must be sent to.

That proximity is the entire argument and it is a strong one. Security findings appear as pull request comments in the review the developer is already conducting, which means no new tool to learn, no separate login, no report distributed by email, and no gap between the code being written and the problem being raised.

Secret scanning is the capability with the most immediate value and the least controversy. Credentials committed to repositories are among the most common causes of breaches, developers do it accidentally and constantly, and detecting a key at push time prevents an exposure that would otherwise be discovered by whoever finds it first.

The dependency side benefits from GitHub's position in the ecosystem. Because so much open source development happens on the platform, the advisory data behind dependency review is unusually well informed, and the same infrastructure that hosts a vulnerable package hosts the advisory describing it.

Pricing follows GitHub's tiers, free for individuals and organisations at the basic level, four dollars for the Team tier, with Advanced Security available on higher plans and compute charged separately from eighteen cents.