Code scanning arrives with CodeQL at its core
GitHub’s code scanning feature, built on the CodeQL analysis engine, lets developers run security analysis on every push, pull request, schedule, or ad hoc basis. The engine traces data flows through applications to surface vulnerabilities such as SQL injection, cross-site scripting, and remote code execution. Since its beta launch early in the year, code scanning has gained an API for results, support for third-party CI/CD tools, and general availability on GitHub Enterprise Cloud, with GitHub Enterprise Server 3.0 to follow.
The CodeQL engine itself also improved: compiled queries now consume 90% less space, and library and framework support has expanded across all languages. The VS Code extension for writing and running CodeQL queries added an AST viewer and jump-to-definition. GitHub also contributed to the OpenSSF CVE Benchmark project, which is now open source.
Secret scanning expands coverage
Secret scanning, which watches repositories for known secret formats, now covers private repositories in beta on GitHub Enterprise Cloud, with beta availability planned for GitHub Enterprise Server 3.0. In public repositories, providers are notified when secrets leak; in private ones, repository owners are notified so they can rotate credentials. An API was added to help resolve secret scanning results programmatically.
The number of token scanners grew substantially, with new partners including Adafruit, Samsara, Shopify, MessageBird, Dynatrace, SSLMate, Frame.io, Clojars, Mailchimp, Finicity, Plivo, and Doppler, bringing the total to 33 scanning partners. Secret scanning can also detect tokens inside ZIP archives.
Dependabot keeps dependencies current and secure
Dependabot version updates generate automated pull requests to keep dependencies current even when no vulnerabilities are present. The theory: if you update regularly, you'll be ready to act when a real vulnerability appears. To enable version updates, developers commit a dependabot.yml configuration file to their repository. Since beta, version updates have added support for GitHub Actions workflows, Ruby (Bundler) vendoring, Go vendoring with go mod tidy support, and dependencies from private git repositories.
For vulnerability responses, Dependabot alerts and security updates notify developers and propose automated fixes. Teams can now be assigned to review Dependabot pull requests, error messages explain why an update isn't possible, and notification noise has been reduced—alerts now fire only for high and critical severity vulnerabilities.
Dependency review surfaces what's changing in a PR
Dependency review gives developers a clear picture of dependencies before they merge a pull request. The feature shows which dependencies are being introduced, changed, or removed, along with details on vulnerabilities, age, usage, and license. It's in beta for all public repositories and available to Advanced Security customers on GitHub Enterprise Cloud.
Advisory database becomes a single source of truth
After GitHub acquired npm, the GitHub Advisory Database ingested all npm security advisories. Combined with existing data from maintainers and third-party sources like the National Vulnerability Database, the database now serves as a unified reference for security advisories across ecosystems. For maintainers, filing a security advisory and obtaining a CVE is simpler: advisories retain edit history and now support giving credit to security researchers who report issues.
Simplified enablement across repositories
Enabling these security features has become easier at both the repository and organization levels. Dependency graph, Dependabot alerts, Dependabot security updates, and Dependabot version updates are free tools. Code scanning, secret scanning, and dependency review are free for public repositories and bundled with GitHub Advanced Security for Enterprise customers.
