Most code has never been reviewed. This scan changes that.

Most security leaders share the same suspicion: there are vulnerabilities in the codebase that we don’t know about. That suspicion is usually right. The uncomfortable truth is that most code never gets a thorough security review, so vulnerabilities quietly accumulate in active repositories across languages and teams—often undetected until something goes wrong. Manual reviews can't keep up, and narrowly scoped tools leave blind spots.

GitHub is trying to change that with the Code Security Risk Assessment, a free one-click scan that reveals vulnerabilities hiding in your organization’s code. No license required, no configuration needed, no commitment. The assessment is available to organization admins and security managers on GitHub Enterprise Cloud and GitHub Team plans, and scans up to 20 of your most active repositories using CodeQL static analysis. The scan is completely free—you won’t be charged for licenses, and Actions minutes used for scanning don’t count against your quota.

What the report tells you

The assessment delivers a dashboard summarizing findings across four dimensions:

  • Total vulnerabilities broken down by severity—critical, high, medium, and low
  • Vulnerabilities by language, showing which parts of your codebase carry the most risk
  • Rules detected, identifying the specific classes of security issues found, how many repositories they affect, and severity
  • Most vulnerable repositories, so you know which areas need remediation first

The report also estimates how many vulnerabilities could be auto-fixed with Copilot Autofix, GitHub’s AI-powered remediation tool, giving you a concrete sense of how quickly you could begin reducing risk. When you're ready, you can enable Code Security directly from the results page with one click.

A more complete security picture

If you already run GitHub's Secret Risk Assessment, the Code Security Risk Assessment extends the same idea to source code vulnerabilities. Since launching last year, the secret version has helped thousands of organizations understand their exposure to leaked credentials. In 2025 alone, customers using Secret Protection scanned nearly 2 billion pushes and blocked 19 million secret exposures.

Both assessments now run together from a single entry point. A tabbed interface lets you switch between secret exposure and code vulnerability findings, providing a unified view of your organization's overall security posture in minutes. For teams not directly responsible for running security scans, the combined results still help align on where risk lives and what to fix first.

From found to fixed

Knowing where vulnerabilities sit is only the first step—fixing them is what reduces risk. GitHub's 2025 data shows the tools to close that gap are working:

  • 460,258 security alerts were fixed using Copilot Autofix
  • 50% of vulnerability alerts were resolved directly in pull requests—where developers already work
  • Mean time to remediation was nearly twice as fast with Copilot Autofix (0.66 hours) versus manual fixes (1.29 hours)

Code Security, GitHub's vulnerability scanning and fix product, pairs with the assessment to turn findings into patches. The tools complement each other: the assessment shows you why you need protection, and the product delivers it—stopping credentials from leaking and fixing code vulnerabilities where developers are already working.