Tool profile
GitHub Advanced Security: cost, fit and limits
GitHub Advanced Security is a set of security add-ons from GitHub, a Microsoft company, that bundles Dependabot dependency updates, dependency review, CodeQL code scanning and secret detection into repositories hosted on GitHub.com, priced per active committer.
What to know first
For software composition analysis, the relevant piece is GitHub Code Security at $30 per active committer per month, which includes Dependabot updates, dependency review, CodeQL and Copilot Autofix. Secret Protection costs $19 per committer and is bought separately. Core features are free on public repositories, and Team and Enterprise plans include most features. The practical question is whether your code already lives on GitHub, since the value comes from pull request integration rather than a standalone scanner.
GitHub Advanced Security at a glance
| Maker | GitHub, Inc. (Microsoft), United States |
|---|---|
| Free plan | No |
| Entry price | $30 per active committer per month (Code Security) |
| API access | Yes |
| Category | Best AI Software Composition Analysis Tools in 2026, rank 8 of 10 |
| Website | github.com/security/advanced-security |
Who GitHub Advanced Security is best for
Teams already on GitHub
Dependabot update pull requests and dependency review appear where code review already happens, so no separate dashboard or login is needed to act on a finding.
Open source maintainers
Public repositories get core security features at no cost, which suits maintainers who need alerts on vulnerable packages without a security budget.
Organizations consolidating vendors
A buyer that wants fewer procurement contracts can fold dependency, code and secret checks into an existing GitHub agreement at printed per-committer prices.
GitHub Advanced Security plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free for public repositories | $0 | Core security features on public repositories, including Dependabot alerts, security updates and version updates, at no charge to maintainers. |
| Team and Enterprise plans | Plan price, features vary | Most security features are included with these GitHub plans, with some capabilities labeled as paid add-ons on the plans page. |
| GitHub Code Security | $30 per active committer per month | CodeQL semantic analysis, Copilot Autofix for suggested fixes, Dependabot updates, dependency review and security campaigns across repositories. |
| GitHub Secret Protection | $19 per active committer per month | Push protection, secret scanning, provider and custom patterns and bypass controls. Public leak monitoring is Enterprise only. |
Checked October 2026.
What GitHub Advanced Security does
- Dependabot alerts
- Dependabot notifies a repository about vulnerable dependencies it uses. The alert points to the manifest or lockfile entry, such as a package-lock.json, so a developer sees which file to change.
- Dependabot security updates
- The feature automatically raises a pull request to bump a dependency that has a known vulnerability, which turns an alert into a reviewable change with tests running through the normal workflow.
- Dependabot version updates
- Beyond security fixes, Dependabot opens pull requests to keep dependencies current on a schedule, which prevents the buildup of old versions that make later upgrades risky.
- Preview features
- Reachability analysis and a package firewall were labeled preview on the plans page, and some AI-powered features, including AI Scan and agentic autofix, consume AI Credits that are metered apart from the seat.
How GitHub Advanced Security handles your data
GitHub's general privacy statement names GitHub, Inc. in San Francisco and GitHub B.V. in Amsterdam. It keeps personal data while an account is active and as needed for contracts, and stores or processes it in the user's region, the United States and other countries where its subprocessors operate. EU, UK and Swiss transfers rely on standard contractual clauses and the Data Privacy Frameworks. The statement does not say whether private repository content trains AI models, and it refers to Section E of the GitHub Terms of Service, which was not reviewed for this page.
Where GitHub Advanced Security falls short in practice
- Locked to GitHub. The security features assume repositories hosted on GitHub, so teams using GitLab, Bitbucket or Azure DevOps have no comparable pull request integration and would need another SCA product.
- Preview and credit-metered extras. Reachability and the package firewall were still in preview, and AI features such as agentic autofix draw on AI Credits, so the $30 seat price may not cover every AI function.
Works with
Alternatives to GitHub Advanced Security
GitHub Advanced Security: common questions
Is Dependabot free?
Dependabot alerts and updates are among the core security features GitHub lists as free for public repositories. Private repository coverage depends on the plan, and Code Security at $30 per active committer per month bundles Dependabot updates. The quickstart page did not state which plans include Dependabot.
What is an active committer on GitHub?
The plans page prices both add-ons per active committer per month, meaning a developer who has committed to the repositories where the feature is enabled. The page did not define the counting window in the content reviewed, so check the billing documentation before sizing a quote.
What does GitHub dependency review do?
Dependency review is listed under Code Security and surfaces the dependencies a pull request would add or change, so a reviewer can see risk before merging. The plans page does not describe its policy options in detail, so verify them in the documentation.
Does GitHub Code Security include AI?
Yes, Copilot Autofix is included for suggested fixes, and the page says some AI-powered features, such as AI Scan and agentic autofix, use AI Credits on top of the seat price. Reachability analysis and the package firewall carried a preview label when this was checked.
Can I use it with a repository host other than GitHub?
No for the pull request features. Dependabot, dependency review and Code Security operate on GitHub repositories. A team on GitLab or Bitbucket needs another tool such as Mend.io or Endor Labs, both of which list those hosts among their integrations.