Security that shows up when you need it

For most developers, security tooling feels like an afterthought: another dashboard to check, another batch of alerts to triage, another context switch away from the code you're actually trying to write. And because the warnings often lack context, you're left to research the issue yourself—or worse, chase down false positives until you start tuning the alerts out entirely.

GitHub is taking a different approach by embedding security directly into the development workflow, at the moments when you're already looking at your code. The goal isn't just to detect problems, but to give you a path to fix them without leaving your normal routine.

Catch secrets before they leave your machine

Secrets leaked into code are among the most common and damaging vulnerabilities—and among the hardest to catch if you're only scanning after a feature is done. In 2024, GitHub developers detected more than 39 million secret leaks using Secret Protection, the tool formerly known as Secret Scanning.

Secret Protection runs when you push code to a repository and alerts you if it finds a suspicious token or key. That means you learn about the problem while the code is still fresh, not months later when you've long since moved on. Push protection goes one step further: it blocks the push entirely and shows you exactly where the secret is, so you can fix it before it reaches the remote. If the hit is a false positive or the key is a test credential, you can override the block without friction.

Dependencies: know what's actually exploitable

Committed code almost always relies on open source packages—or transitive dependencies of those packages. A vulnerability buried in that chain can put your whole organization at risk, and discovering it late is a headache nobody wants. Dependabot surfaces known vulnerabilities in your dependencies as soon as they're relevant, and if a patch exists, it will open a pull request for you automatically.

Dependabot alerts now include Exploit Prediction Scoring System (EPSS) data from the Forum of Incident Response and Security Teams. EPSS estimates how likely a vulnerability is to be exploited in the wild, helping you separate urgent issues from low-risk noise. Only about 10% of alerts have an EPSS score above 0.95%, so you can direct your attention to the small subset of alerts that actually matter.

Pull request time: automated scanning and fixes

When you file a pull request, the scanning happens automatically via GitHub Actions. Code Security (formerly Code Scanning) uses the CodeQL semantic analysis engine, which transforms your code into a queryable database to detect known vulnerability patterns, their variants, and potentially unsafe practices. Instead of juggling separate linters and scanners, you get the results in the PR itself.

CodeQL ships with thousands of pre-built queries that cover the most critical vulnerability types, curated for a low false positive rate. If you need something custom, you can write your own queries. But the bigger shift is in remediation: GitHub Copilot Autofix is now included for free on public repositories, and as part of Code Security on private ones. For JavaScript, TypeScript, Java, and Python, it recommends a solution for about 90% of alert types, generating a pull request with the proposed patch. Teams using Autofix have seen up to 60% faster remediation, which is a meaningful improvement in Mean Time to Remediation.

Found means fixed

These protections are designed to stay in the background until something needs your attention. When an alert does appear, it's because there's a concrete problem at the stage of the workflow you're already in—not a future issue that will come back to haunt you after several more features have built on top of it.

Fixing a vulnerability at the point of commit or pull request is far less costly than addressing it weeks later. With actionable suggestions integrated into the tools you're already using, you don't need to be a security expert to write secure code. You just need to review the proposed change that GitHub has already prepared for you. That's the shift-left approach made practical: security enforcement that reduces tickets, doesn't multiply them.