Build security and code quality into your GitHub workflow with integrated tooling.
Quickstart for securing your repository
Manage access to your code. Find and fix vulnerable code and dependencies automatically.
An overview of GitHub's security features.
Planning a trial of GitHub Advanced Security
Prepare your organization to evaluate Advanced Security against clear security and purchasing goals.
Prevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.
You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.
Find and fix vulnerable dependencies you rely on with Dependabot.
Improve code quality at scale with GitHub
Inconsistent code quality slows every team down and adds risk you can't easily see. GitHub Code Quality catches issues before they merge and reports on code health across your organization. Follow this adoption path to evaluate the feature, run a pilot, prove its value, and roll it out at scale.
Best practices for preventing data leaks in your organization
Learn guidance and recommendations to help you avoid private or sensitive data present in your organization from being exposed.
Best practices for maintaining dependencies
Guidance and recommendations for maintaining the dependencies you use, including GitHub's security products that can help.
An overview of GitHub's security features.
An overview of GitHub's security features.
Quickstart for securing your repository
Manage access to your code. Find and fix vulnerable code and dependencies automatically.
Secrets like API keys, passwords, and tokens committed to repositories can be exploited by unauthorized users, creating security, compliance, and financial risk to your organization.
Prevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.
Public monitoring for secret scanning
Public monitoring detects credentials leaked by your enterprise members in public repositories across GitHub, giving you visibility into secret exposure beyond your enterprise's boundaries.
Secure your secrets by stopping them from ever reaching your repository with push protection.
Learn how GitHub's security tools can help you identify, remediate, and prevent secret leaks.
Learn about the different types of secret scanning alerts.
Detect secret types specific to your organization with custom patterns.
Validity checks and extended metadata checks help you prioritize remediation of exposed credentials that pose immediate security risks.
Delegated bypass for push protection
Maintain your secret security while unblocking trusted actors with delegated bypass for push protection.
Bypass requests for push protection
Learn how bypass requests work when push protection blocks commits containing secrets.
When secret scanning detects authentication details for a service provider in a public repository on GitHub, an alert is sent directly to the provider. This allows service providers who are GitHub partners to promptly take action to secure their systems.
Learn about the different types of secrets used by GitHub.
Secret scanning push protection metrics
Understand push protection's performance across your organizations.
Push protection from the command line
Understand how GitHub uses push protection to prevent secret leaks from the command line.
Working with push protection and the GitHub MCP server
Learn how you are protected from leaking secrets during interactions with the GitHub MCP server, and how to bypass a push protection block if you need to.
Working with push protection from the REST API
Learn your options for unblocking your push to GitHub using the REST API if secret scanning detects a secret in the content of your API request.
You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.
Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.
Generate a free code security risk assessment to understand your organization's exposure to vulnerabilities.
About autofix for code scanning
Autofix generates potential fixes for code scanning alerts, helping you remediate existing vulnerabilities.
AI Scan uses an AI-based scanning engine to find security vulnerabilities in pull requests for languages and frameworks not covered by CodeQL.
About setup types for code scanning
Depending on your needs, GitHub offers a default or advanced setup for code scanning.
Integration with code scanning
You can perform code scanning externally and then display the results in GitHub, or configure webhooks that listen to code scanning activity in your repository.
About SARIF files for code scanning
SARIF files convert third-party analyses into alerts on GitHub.
Code scanning alert tracking using issues
Connect security findings to your team's workflow by linking code scanning alerts to issues for tracking and collaboration.
Code scanning merge protection
Code scanning rules prevent pull requests with potential vulnerabilities from being merged.
Multi-repository variant analysis
MRVA lets you test a query in Visual Studio Code by running it against a large number of repositories.
You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.
CodeQL code scanning for compiled languages
Understand how CodeQL analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.
You can choose from different built-in CodeQL query suites to use in your CodeQL code scanning setup.
Custom queries extend CodeQL's built-in security analysis to detect vulnerabilities and enforce coding standards specific to your codebase.
You can use the CodeQL CLI to run CodeQL processes locally on software projects or to generate code scanning results for upload to GitHub.
You can write, run, and test CodeQL queries inside Visual Studio Code with the CodeQL extension.
CodeQL workspaces let you develop and maintain multiple related CodeQL packs together, resolving dependencies between them directly from source.
You can use query reference files to define the location of a query you want to run in tests.
You can choose from different built-in CodeQL query suites to use in your CodeQL code scanning setup.
The tool status page provides visibility into the health and performance of code scanning tools in your repository.
Code scanning on pull requests
Understand how CodeQL and AI Scan find and help prevent vulnerabilities in pull requests across your organizations.
Repository properties for code scanning
You can use repository properties to adjust code scanning to suit your needs.
GitHub helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies, and patching them.
About open source license compliance
Define and enforce license policy for dependencies in your repositories with open source license compliance.
Best practices for maintaining dependencies
Guidance and recommendations for maintaining the dependencies you use, including GitHub's security products that can help.
You can use the dependency graph to identify all your project's dependencies. The dependency graph supports a range of popular package ecosystems.
How the dependency graph recognizes dependencies
The dependency graph automatically analyzes manifest files. You can submit data for dependencies that cannot be detected automatically.
Dependency review lets you catch insecure dependencies before you introduce them to your environment, and provides information on license, dependents, and age of dependencies.
Dependabot alerts help you find and fix vulnerable dependencies before they become security risks.
Dependabot malware alerts help you identify malware in your dependencies to protect your project and its users.
Use metrics to track and prioritize Dependabot alerts across your organization.
Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates.
You can use Dependabot to keep the packages you use updated to the latest versions.
Understand the frequency and customization options of pull requests for version and security updates.
Multi-ecosystem updates combine dependency updates across multiple package ecosystems into a single pull request, reducing review overhead and simplifying your update workflow.
The dependabot.yml controls automated dependency updates in your repository.
Automatic Dependabot access to GitHub-hosted registries
Keep your private dependencies up to date reliably by granting Dependabot automatic access to GitHub Packages and Container registry, so you never need to create or rotate credentials for these registries.
Control how Dependabot handles security alerts, including filtering, ignoring, snoozing, or triggering security updates.
Dependabot on GitHub Actions runners
GitHub automatically runs the jobs that generate Dependabot pull requests on GitHub Actions if you have GitHub Actions enabled for the repository. When Dependabot is enabled, these jobs will run by bypassing Actions policy checks and disablement at the repository or organization level.
GitHub logs every update job run by Dependabot, giving you visibility into version updates, security patches, and automated rebases across your dependencies.
Learn about immutable releases and how they can help you maintain the integrity of your software supply chain.
The linked artifacts page helps you audit and prioritize your organization's builds on GitHub, regardless of where the artifacts are stored.
GitHub Code Quality catches quality issues before merge, delivers one-click Copilot-powered fixes inline, and checks your code coverage.
Code Quality enablement across organizations and enterprises
GitHub Code Quality can cover one repository or thousands from a single control point, giving every team the same quality baseline and giving you the guardrails to keep it there.
An AI-powered agent can analyze your repository and generate a working code coverage workflow, so you can start tracking test coverage without manually authoring CI configuration.
Research known security vulnerabilities and malware in open source packages, so you can understand and remediate the risks in your dependencies.
Enterprises can alert their internal repositories to vulnerabilities and ship automated fixes with Dependabot, using advisories that stay private to a single enterprise.
Repository security advisories
You can use repository security advisories to privately discuss, fix, and publish information about security vulnerabilities in your public repository.
Global security advisories are CVEs and GitHub-originated advisories affecting the open source world, located in the GitHub Advisory Database.
Coordinated disclosure of security vulnerabilities
Vulnerability disclosure is a coordinated effort between security reporters and repository maintainers.
Exposure to vulnerabilities in your code and in dependencies
Understand how vulnerabilities in your own code and in third-party dependencies contribute to your organization's overall security exposure, and how to measure and reduce that risk.
Best practices for selecting pilot repositories
The right pilot repositories demonstrate value quickly and prepare your organization for broader enablement of GitHub Secret Protection.
Enabling security features at scale
You can quickly secure your organization at scale with security configurations and global settings.
You can gain insights into the overall security landscape of your organization or enterprise and identify repositories that require intervention using security overview.
You can fix security alerts at scale by creating security campaigns and collaborating with developers to burn down your security backlog.
GitHub provides a variety of tools you can use to audit and monitor actions taken in response to security alerts.
Increase your governance over security alerts with delegated alert dismissal.
Enabling public monitoring for your enterprise
Start detecting secrets your enterprise members leak in public repositories outside your enterprise's boundaries.
Allowing use of GitHub Code Quality in your enterprise
Set enterprise policies for Code Quality to give organizations access while keeping repository enablement under your control.
Setting up Dependabot to run on github-hosted action runners using the Azure Private Network
You can configure an Azure Virtual Network (VNET) to run Dependabot on GitHub-hosted runners.
Creating a custom security configuration
Build a custom security configuration to meet the specific security needs of repositories in your organization.
Applying a custom security configuration
You can apply your custom security configuration to repositories in your organization to meet the specific security needs of those repositories.
Configuring global security settings for your organization
Customize Advanced Security features for your organization by defining global settings that ensure consistent security standards and safeguard all your repositories.
Editing a custom security configuration
Meet the security needs of your repositories by editing your custom security configuration.
Filtering repositories in your organization using the repository table
You can filter the repository table for your organization to better manage the security settings of specific repositories.
Detaching repositories from their security configurations
Go back to managing a repository's security settings on an individual basis.
Deleting a custom security configuration
You can delete unnecessary custom security configurations in your organization.
Running the secret risk assessment for your organization
Determine your organization's exposure to leaked secrets by generating a secret risk assessment report.
Running the code security risk assessment for your organization
Determine your organization's exposure to vulnerabilities by generating a code security risk assessment report.
Viewing your security risk assessment reports
Understand your organization's exposure to leaked secrets and code vulnerabilities by viewing your most recent security risk assessment reports.
Estimating the price of Secret Protection
Learn how to use the pricing calculator to estimate the monthly cost of GitHub Secret Protection for your repositories.
Pricing and enabling GitHub Secret Protection
Secure your organization's secrets within your budget by enabling GitHub Secret Protection.
Configuring default setup for code scanning at scale
You can quickly configure code scanning for repositories across your organization using default setup.
Configuring advanced setup for code scanning with CodeQL at scale
Establish a highly customizable code scanning setup at scale with a script.
Enforcing dependency review across an organization
Dependency review lets you catch insecure dependencies before you introduce them to your environment. You can enforce the use of the dependency review action across your organization.
Giving security features access to private registries
If your organization uses private registries, you can improve the results of code scanning analysis and enable Dependabot to maintain more dependencies by setting up access to these registries.
Managing your paid use of Advanced Security
Control the costs of GitHub Secret Protection and GitHub Code Security in your organization.
Enabling secret scanning for your repository
You can configure how GitHub scans your repositories for leaked secrets and generates alerts.
Enabling secret scanning for generic patterns
You can enable secret scanning to detect additional potential secrets at the repository and organization levels.
Enabling generic secret detection for AI-detected secrets
You can enable generic secret detection for your repository or organization. Alerts for generic secrets, such as passwords, are displayed in a separate list on the secret scanning alerts page.
Defining custom patterns for secret scanning
Protect your unique secret types by defining custom patterns with regular expressions.
Generating regular expressions for custom patterns with AI
You can use the AI-powered regular expression generator to write regular expressions for custom patterns. The generator uses an AI model to generate expressions that match your input, and optionally example strings.
You can view, edit, and remove custom patterns, as well as enable push protection for custom patterns.
Excluding folders and files from secret scanning
You can customize secret scanning to automatically close alerts for secrets found in specific directories or files by configuring a secret_scanning.yml file in your repository.
Enabling validity checks for your repository
Enabling validity checks on your repository helps you prioritize the remediation of alerts as it tells you if a secret is active or inactive.
Enabling extended metadata checks for your repository
Learn how to enable extended metadata checks for detected secrets so alerts detected by secret scanning include additional information that help you assess and remediate leaks faster.
Enabling push protection for your repository
With push protection, secret scanning blocks contributors from pushing secrets to a repository and generates an alert whenever a contributor bypasses the block.
Managing push protection for users
You can control GitHub's ability to block your pushes that may contain secrets.
Blocking pull request merges that contain secrets
Prevent exposed secrets from reaching protected branches by requiring contributors to resolve secret scanning alerts before merging.
Working with push protection from the command line
Learn your options for unblocking your push from the command line to GitHub if secret scanning detects a secret in your changes.
Working with push protection in the GitHub UI
Learn your options for unblocking your commit when secret scanning detects a secret in your changes.
Enabling delegated bypass for push protection
Control who can push code containing secrets by requiring bypass approval from designated reviewers.
Exempting trusted actors from push protection
Reduce friction for trusted automation by granting exemptions from push protection.
Managing requests to bypass push protection
As a member of the bypass list for an organization or repository, you can review bypass requests from other members of the organization or repository.
Reviewing requests to bypass push protection
Approve or deny requests from contributors who need to push commits containing secrets to your organization's repositories.
Configuring default setup for code scanning
Quickly set up code scanning to find and fix vulnerable code automatically.
Configuring advanced setup for code scanning
You can configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration.
Editing your configuration of default setup
You can edit your existing configuration of default setup for code scanning to better meet your needs.
Use the tool status page for code scanning
View real-time tool status, identify configuration problems, and download reports to keep your code scanning analysis running smoothly.
Set code scanning merge protection
Secure your codebase by blocking pull requests that fail code scanning checks.
Configuring larger runners for default setup
Run code scanning default setup more quickly on bigger codebases using larger runners.
CodeQL code scanning for compiled languages
Understand how CodeQL analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.
To get started with the CodeQL CLI, you need to download and set up the CLI so that it can access the tools and libraries required to create and analyze databases.
Writing custom queries for the CodeQL CLI
You can write your own CodeQL queries to find specific vulnerabilities and errors.
Publishing and using CodeQL packs
Share or download a CodeQL pack, then analyze your CodeQL database.
Verify your custom CodeQL queries and catch breaking changes before they affect your code scanning results following new releases of the CodeQL CLI.
Ensure your CodeQL query help files are valid by previewing them as Markdown.
Downloading CodeQL databases from GitHub
Expand the coverage of the CodeQL CLI by adding ready-made databases.
Checking out the CodeQL CLI source code
Set up the CodeQL CLI directly from the source code.
Using incremental analysis with the CodeQL CLI
Get faster CodeQL results on pull requests by analyzing only what changed. Incremental analysis can reduce scan times by up to 10x when you run the CodeQL CLI in your own CI/CD system.
Specifying command options in a CodeQL configuration file
Save time by adding your frequently used command options and custom CodeQL packs to a CodeQL configuration file.
Creating CodeQL CLI database bundles
Create a database bundle with CodeQL troubleshooting information.
Installing CodeQL for Visual Studio Code
To get started with CodeQL for Visual Studio Code, you need to install and set up the extension.
You can work with CodeQL databases using the extension.
You can run queries on CodeQL databases and view the results in Visual Studio Code.
Exploring data flow with path queries
Detect potential vulnerabilities by running path queries and analyzing your data flow.
Running CodeQL queries at scale with multi-repository variant analysis
You can run CodeQL queries on a large number of repositories on GitHub from Visual Studio Code.
You can view, write, and edit CodeQL model packs in Visual Studio Code.
You can work from a template to write your own code to create a custom query to analyze a specific language.
Managing CodeQL query packs and library packs
Download and install dependencies for your CodeQL query and library packs in Visual Studio Code using the CodeQL extension.
Exploring the structure of your source code
Visualize how your code maps to CodeQL classes in VS Code.
Testing CodeQL queries in Visual Studio Code
You can run unit tests for CodeQL queries using the Visual Studio Code extension.
You can edit the settings for the CodeQL for Visual Studio Code extension to suit your needs.
When you're working with CodeQL, you need access to the standard libraries and queries.
Managing the CodeQL CLI in the VS Code extension
The CodeQL for Visual Studio Code extension uses the CodeQL CLI to compile and run queries.
Accessing logs for CodeQL in Visual Studio Code
If you need to troubleshoot problems with CodeQL for Visual Studio Code, there are several logs you can access.
Using code scanning with your existing CI system
You can analyze your code with the CodeQL CLI or another tool in a third-party continuous integration system and upload the results to GitHub. The resulting code scanning alerts are shown alongside any alerts generated within GitHub.
Uploading a SARIF file to GitHub
You can upload SARIF files generated outside GitHub and see code scanning alerts from third-party tools in your repository.
Enable Dependabot alerts to be generated when a new vulnerable dependency is found in one of your repositories.
Configuring Dependabot malware alerts
Prevent malware attacks by identifying and remediating malicious dependencies.
Protecting endpoints with GitHub package firewall
Protect dependency installations on developer machines, AI agents, and CI runners with GitHub package firewall.
Configuring Dependabot security updates
You can use Dependabot security updates or manual pull requests to easily update vulnerable dependencies.
Configuring Dependabot version updates
You can configure your repository so that Dependabot automatically updates the packages you use.
Managing innersource advisories
Create, distribute, and withdraw enterprise-scoped advisories to alert your internal repositories to vulnerabilities and ship fixes automatically.
Keeping your actions up to date with Dependabot
You can use Dependabot to keep the actions you use updated to the latest versions.
Configuring multi-ecosystem updates for Dependabot
Reduce the number of Dependabot pull requests you receive by grouping updates across multiple ecosystems into a single, consolidated pull request.
You can allow users to identify their projects' dependencies by enabling the dependency graph.
Exploring the dependencies of a repository
You can use the dependency graph to see the packages your project depends on and the repositories that depend on it. In addition, you can see any vulnerabilities detected in its dependencies.
Configuring automatic dependency submission for your repository
You can use automatic dependency submission to submit transitive dependency data in your repository. This enables you to analyze these transitive dependencies using the dependency graph.
Using the dependency submission API
You can use the dependency submission API to submit dependencies for projects, such as the dependencies resolved when a project is built or compiled.
Verifying the integrity of a release
You can avoid tampering and accidental changes by ensuring the releases you use have not been modified after publication.
Configuring open source license policies
Create and enforce open source license policies to control which licenses your dependencies are allowed to use.
Customizing auto-triage rules to prioritize Dependabot alerts
You can create your own auto-triage rules to control which alerts are dismissed or snoozed, and which alerts you want Dependabot to open pull requests for.
Using GitHub preset rules to prioritize Dependabot alerts
Focus on alerts that matter by auto-dismissing low impact development alerts for npm dependencies.
Customizing pull requests for Dependabot security updates
Learn how to customize Dependabot pull requests for security updates to align with your project's security priorities and workflows.
Controlling which dependencies are updated by Dependabot
Learn how to configure your dependabot.yml file so that Dependabot automatically updates the packages you specify, in the way you define.
Configuring the dependency review action
You can use the dependency review action to catch vulnerabilities before they are added to your project.
Configuring notifications for Dependabot alerts
Optimize how you receive notifications about Dependabot alerts.
Configuring access to private registries for Dependabot
You can configure Dependabot to access dependencies stored in private registries. You can store authentication information, like passwords and access tokens, as encrypted secrets and then reference these in the Dependabot configuration file. If you have registries on private networks, you can also configure Dependabot access when running Dependabot on self-hosted runners.
Removing Dependabot access to public registries
Examples of how you can configure Dependabot to only access private registries by removing calls to public registries.
Managing pull requests for dependency updates
You manage pull requests raised by Dependabot in much the same way as other pull requests, but there are some extra options.
Configuring Dependabot on GitHub-hosted runners
Enable Dependabot on GitHub-hosted runners to more easily identify Dependabot job errors and manually detect and troubleshoot failed runs.
Configuring Dependabot on self-hosted runners
You can configure self-hosted runners that Dependabot uses to access your private registries and internal network resources.
Re-running Dependabot jobs on GitHub Actions
Resolve run failures and manually update your dependencies by re-running Dependabot jobs.
Listing dependencies configured for version updates
You can view the dependencies that Dependabot monitors for updates.
Guidance for the configuration of private registries for Dependabot
This article contains detailed information about configuring private registries, as well as commands you can run from the command line to configure your package managers locally.
Resolving a blocked host in a Dependabot update job
Diagnose an update job that fails because Dependabot could not reach a host, and allow the host it needs.
Preventing changes to your releases
You can enforce immutable releases for a repository or organization to prevent potential vulnerabilities.
Exporting a software bill of materials for your repository
You can export a software bill of materials or SBOM for your repository from the dependency graph. SBOMs allow transparency into your open source usage and help expose supply chain vulnerabilities, reducing supply chain risks.
Uploading storage and deployment data to the linked artifacts page
Associate packages and builds in your organization with storage and deployment data.
Auditing your organization's builds on the linked artifacts page
View or export metadata for build runs, storage details, and deployment context.
Removing artifacts from the linked artifacts page
Set the storage and deployment status of artifacts to reflect that they are no longer in use.
Filtering alerts in security overview
Find the security alerts that matter most by filtering your security overview data.
Creating and managing security campaigns
You can manage security campaigns directly from the security overview for your organization.
Use the campaign tracking views to monitor remediation progress, identify stalled work, and measure campaign impact across your organization.
Fixing alerts in a security campaign
Learn how to find and fix alerts in a security campaign.
Reviewing alert dismissal requests
Triage and resolve security alerts in your organization or enterprise by regularly reviewing alert dismissal requests.
Monitoring alerts from secret scanning
You can configure how secret scanning notifies you about secret scanning alerts, and audit how your team responds to these alerts.
Viewing and filtering alerts from secret scanning
Learn how to find and filter secret scanning alerts for users for your repository.
Resolving alerts from secret scanning
After reviewing the details of a secret scanning alert, you should fix and then close the alert.
Enabling delegated alert dismissal for secret scanning
You can use delegated alert dismissal to control who can dismiss an alert found by secret scanning.
Assessing code scanning alerts for your repository
From the security view, you can explore and evaluate alerts for potential vulnerabilities or errors in your project's code.
Triaging code scanning alerts in pull requests
When code scanning identifies a problem in a pull request, you can review the highlighted code and resolve the alert.
Linking code scanning alerts to GitHub issues
Create or connect GitHub issues to code scanning alerts to track security fixes in your team's workflow.
Resolving code scanning alerts
From the security view, you can view, fix, or dismiss alerts for potential vulnerabilities or errors in your project's code.
Managing access to agentic autofix for code scanning
Control the rollout of agentic autofix across your enterprise, organizations, and repositories.
Enabling delegated alert dismissal for code scanning
You can use delegated alert dismissal to control who can dismiss an alert found by code scanning.
Disabling Copilot Autofix for code scanning
You can disable Copilot Autofix for an enterprise, organization, or repository.
Viewing and updating Dependabot alerts
If GitHub discovers insecure dependencies in your project, you can view alert details on the Dependabot tab of your repository. Then, you can update your project to resolve or dismiss the alert.
Managing Dependabot malware alerts
Find and triage malicious dependencies in your project with Dependabot malware alerts.
Managing alerts that have been automatically dismissed by a Dependabot auto-triage rule
You can filter to see which alerts have been auto-dismissed by a rule, and you can reopen dismissed alerts.
Enabling delegated alert dismissal for Dependabot
Increase your governance over your Dependabot alerts with delegated alert dismissal.
Turn on Code Quality to give your teams a consistent quality baseline: automatically catching, fixing, and reporting code quality issues in pull requests and on your default branch.
Stop Code Quality scans on a repository or across your organization, and know what happens to billing and your existing data before you do.
Rolling out GitHub Code Quality at scale
Bring Code Quality to every team with confidence by piloting on a small group first, then expanding once your quality thresholds are tuned.
Setting code quality thresholds for pull requests
Keep low-quality changes out of your codebase by using Code Quality thresholds to block pull requests that don't meet your standards.
Setting up code coverage for your repository
Use built-in code coverage from Code Quality to find untested code on pull requests, without paying for or maintaining a separate third-party service.
Setting code coverage thresholds for pull requests
Prevent pull requests from being merged when uploaded code coverage falls below the levels your team requires.
Fixing code quality findings on a pull request
Keep quality issues out of your default branch by applying autofixes, delegating remediation work to Copilot, or dismissing irrelevant findings.
Resolving a block on your pull request
Identify and resolve a code quality or coverage threshold block on your pull request so you can merge your changes.
Viewing code coverage on pull requests
Review the coverage summary posted on your pull requests to identify files with low or declining code coverage.
Fixing code quality findings in your repository backlog
Generate autofixes for findings on the default branch of your repository, or dismiss findings that aren't relevant.
Fixing code quality findings in recently merged files
Apply autofixes or delegate remediation work to Copilot for quality issues detected by AI-powered analysis of recently merged code.
Interpreting the code quality results for your repository
Use Code Quality results to assess the maintainability and reliability of your codebase, so your teams can focus remediation where it matters most.
Exploring GitHub Code Quality results in your organization
Use the organization-level Code Quality dashboard to spot repositories that need attention and track your organization's code health at a glance.
Viewing and managing GitHub Code Quality costs
Keep your Code Quality spend predictable by seeing exactly where charges come from and using the levers that bring them down.
Adding a security policy to your repository
You can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.
Configuring private vulnerability reporting for a repository
Owners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting.
Privately reporting a security vulnerability
Some public repositories configure security advisories so that anyone can report security vulnerabilities directly and privately to the maintainers.
Managing privately reported security vulnerabilities
Repository maintainers can manage security vulnerabilities that have been privately reported to them by security researchers for repositories where private vulnerability reporting is enabled.
Creating a repository security advisory
You can create a draft security advisory to privately discuss and fix a security vulnerability in your open source project.
Publishing a repository security advisory
You can publish a security advisory to alert your community about a security vulnerability in your project.
Adding a collaborator to a repository security advisory
Add other users or teams to collaborate on a security advisory with you.
Removing a collaborator from a repository security advisory
When you remove a collaborator from a repository security advisory, they lose read and write access to the security advisory's discussion and metadata.
Editing a repository security advisory
You can edit the metadata and description for a repository security advisory if you need to update details or correct errors.
Deleting a repository security advisory
You can delete a repository security advisory that you've published by contacting Support.
Browsing security advisories in the GitHub Advisory Database
You can browse the GitHub Advisory Database to find CVEs and GitHub-originated advisories affecting the open source world.
Editing security advisories in the GitHub Advisory Database
Improve advisories published in the GitHub Advisory Database by making community contributions.
Scanning for secrets with the GitHub MCP server
Detect exposed secrets in real time from your AI coding agent, before they ever reach your repository.
Assessing the security risk of your code
You can use security overview to see which teams and repositories are affected by security alerts, and identify repositories for urgent remedial action.
Assessing adoption of security features
See which teams and repositories have already enabled features for secure coding, and identify any that are not yet protected.
Finding repositories with security alerts using security overview
Monitor and prioritize security alerts with security overview.
Exporting data from security overview
From security overview, you can export CSV files of the data used for your organization or enterprise's overview, risk, coverage, and code scanning pull request insights pages.
Monitor your organization security posture, identify high-risk repositories, and track alert remediation progress using the overview dashboard in security overview.
Viewing code scanning metrics for pull requests
Monitor how CodeQL and AI Scan perform in pull requests across your organizations to identify repositories where you may need to take action.
Viewing metrics for secret scanning push protection
Monitor push protection's performance across your organization to identify repositories where you may need to take action.
Viewing and managing public monitoring alerts
Find and manage alerts for credentials your enterprise members have exposed in public repositories across GitHub.
Viewing metrics for Dependabot alerts
You can use security overview to see how many Dependabot alerts are in repositories across your organization, to prioritize the most critical alerts to fix, and to identify repositories where you may need to take action.
Exporting the secret risk assessment report to CSV
Export the secret risk assessment report to a CSV file for detailed investigation and stakeholder sharing.
Viewing code scanning logs from GitHub Actions
View the output from a code scanning analysis in GitHub Actions.
Access job logs to troubleshoot failed Dependabot updates and understand what is happening.
Viewing metrics for custom patterns
Find out how many alerts are being raised and addressed for a custom pattern.
Changing the "used by" data for a repository
Display your repository's dependents for a different package.
Security overview dashboard metrics
Detailed explanations of metrics, calculations, and data visualizations on the overview page of your security overview.
Available filters for security overview
Reference for all available filters you can use to narrow security overview data.
Security configuration enforcement
Understand the complexities of enforcing security configurations.
Security configuration statuses
Each repository that has a security configuration applied to it has a configuration status that reflects the current state of the relationship between the repository and the configuration.
A repository is using advanced setup for code scanning
You see an error when you try to attach a security configuration with default code scanning enabled to repositories that use advanced setup for code scanning.
Default setup for code scanning overrides advanced setup
You apply a security configuration with "Enabled with advanced setup allowed" and the existing advanced setup for code scanning is ignored in some repositories.
Diagnosing security configuration issues
Identify repositories where the security configuration could not be attached, or where the configuration relationship has changed, and follow guidance to remediate the problem.
Not enough GitHub Advanced Security licenses
If you are on a subscription-based billing model for GHAS, you need available GHAS licenses to enable GHAS features on a private repository.
Understanding GitHub secret types
Learn about the usage, scope, and access permissions for GitHub secrets.
Supported secret scanning patterns
Lists of supported secrets and the partners that GitHub works with to prevent fraudulent use of secrets that were committed accidentally.
Secret scanning detection scope
Secret scanning uses pattern matching and validation to detect secrets. Detection varies based on pattern pairs, token types, and push protection settings.
Use specific regular expression syntax to define accurate custom patterns for secret scanning.
Contents of the secret risk assessment report CSV
Understand the data included in the CSV export of the secret risk assessment report.
Secret scanning pattern configuration data
Understand the data displayed in the secret scanning pattern configuration page to make informed decisions about push protection settings.
Workflow configuration options for code scanning
Edit your workflow file to configure how advanced setup scans the code in your project for vulnerabilities and errors.
SARIF support for code scanning
Ensure your SARIF files from third-party tools comply with GitHub's standards.
GitHub token is required to upload SARIF results
You need to provide an authentication method for the upload process to use to access the repository.
Code scanning can only process syntactically valid SARIF files. Invalid files are rejected.
SARIF results exceed one or more limits
Learn how to resolve problems when a SARIF file is rejected by code scanning because one or more limits is exceeded.
SARIF results file is too large
You cannot upload a SARIF results file larger than 10 MB to code scanning. Explore ways to generate a smaller file containing the highest impact results.
Upload fails because GitHub Code Security is disabled
You can only upload SARIF results to private or internal repositories where GitHub Code Security is enabled.
Upload was rejected because CodeQL default setup is enabled for code scanning
You cannot upload SARIF results generated by the CodeQL action or CodeQL CLI when default setup for code scanning is enabled. Check your configuration and decide whether to keep default setup or unblock SARIF upload.
Recommended hardware resources for running CodeQL
Recommended specifications (RAM, CPU cores, and disk) for running CodeQL analysis on self-hosted machines, based on the size of your codebase.
CodeQL build options and steps for compiled languages
Learn how CodeQL builds compiled languages, including available build modes and language-specific autobuild behavior for C/C++, C#, Go, Java, Kotlin, Rust, and Swift.
Learn about the CodeQL queries that code scanning uses to analyze code.
GitHub Actions queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in GitHub Actions workflow files when you select the default or the security-extended query suite.
C and C++ queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in C or C++ when you select the default or the security-extended query suite.
C# queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in C# when you select the default or the security-extended query suite.
Go queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Go (Golang) when you select the default or the security-extended query suite.
Java and Kotlin queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Java or Kotlin when you select the default or the security-extended query suite.
JavaScript and TypeScript queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in JavaScript or TypeScript when you select the default or the security-extended query suite.
Python queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Python when you select the default or the security-extended query suite.
Ruby queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Ruby when you select the default or the security-extended query suite.
Rust queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Rust when you select the default or the security-extended query suite.
Swift queries for CodeQL analysis
Explore the queries that CodeQL uses to analyze code written in Swift when you select the default or the security-extended query suite.
You can output SARIF from the CodeQL CLI and share static analysis results with other systems.
Understand CSV results from the CodeQL CLI.
Understand the compatibility, contents, and structure of CodeQL packs.
Control how the CodeQL CLI builds databases for analysis with extractor options.
Exit codes signify the status of a command after the CodeQL CLI runs it.
Convert result data from BQRS into other forms.
Compute the difference between two result sets.
[Plumbing] Compute a stable hash of a BQRS file.
Display metadata for a BQRS file.
[Plumbing] Interpret data in a single BQRS.
[Experimental] Add a piece of diagnostic information to a database.
Analyze a database, producing meaningful results in the context of the
source code.
Create a relocatable archive of a CodeQL database.
Compact a CodeQL database on disk.
Create a CodeQL database for a source tree that can be analyzed using
one of the CodeQL products.
[Experimental] Export diagnostic information from a database for a
failed analysis.
[Plumbing] Final steps in database creation.
[Advanced] [Plumbing] Import unfinalized database(s) into another
unfinalized database.
[Plumbing] Index standalone files with a given CodeQL extractor.
[Plumbing] Create an empty CodeQL database.
[Plumbing] Interpret computed query results into meaningful formats
such as SARIF or CSV.
[Plumbing] Print a summary of the baseline lines of code seen.
[Plumbing] Run a set of queries together.
[Plumbing] Run a single command as part of a traced build.
Extracts a CodeQL database archive.
Upgrade a database so it is usable by the current tools.
[Plumbing] Check a particular dataset for internal consistency.
[Plumbing] Clean up temporary files from a dataset.
[Plumbing] Import a set of TRAP files to a raw dataset.
[Plumbing] Collect statistics about the relations in a particular
dataset.
[Plumbing] Upgrade a dataset so it is usable by the current tools.
[Experimental] [Plumbing] Add a piece of diagnostic information.
[Experimental] Export diagnostic information for a failed analysis.
[Deep plumbing] Server for running multiple commands while avoiding
repeated JVM initialization.
[Plumbing] On-line support for the QL language in IDEs.
[Plumbing] Run one or more queries against a dataset.
[Plumbing] Support for running queries from IDEs.
[Plumbing] Support for running queries from IDEs.
[Plumbing] Run upgrade scripts on an existing raw QL dataset.
generate extensible-predicate-metadata
[Experimental] [Deep plumbing] Report the extensible predicates
found in the given pack.
[Advanced] Create a summary of a structured log file.
[Plumbing] Generate a file that can be used for the
--overlay-changes option to
codeql database create when extracting an overlay database.
Generate end-user query help from .qhelp files.
[Deep plumbing] Merges multiple SARIF files into a single SARIF file.
Uploads a SARIF file to GitHub code scanning.
Adds a list of QL library packs with optional version
ranges as dependencies of the current package, and then installs them.
[Plumbing] Bundle a QL library pack.
Install dependencies for this pack, verifying that the
existing lock file is up to date.
[Plumbing] Builds the contents of a QL package from
source code.
Download the set of qlpacks referenced by the query
spec of the command line from the registry. Packs can be provided by
name or implicitly inside of a query suite (.qls) file.
Initializes a qlpack in the specified directory.
Install dependencies for this pack.
[Deep plumbing] List the CodeQL packages rooted at
this directory. This directory must contain a qlpack.yml or
.codeqlmanifest.json file.
[Plumbing] Compute the set of files to be included in
a QL query pack or library pack.
Publishes a QL library pack to a package registry.
[Plumbing] Compute the set of required dependencies
for this QL pack.
Update the dependencies for this pack to the latest
available versions.
Compile or check QL code.
[Plumbing] Read an intermediate representation of a compiled query
from a .qlo file.
Autoformat QL source code.
Run a single query.
[Deep plumbing] Report metadata about the database.
[Experimental] [Deep plumbing] Determine accessible extensions. This
includes machine learning models and data extensions.
[Experimental] [Deep plumbing] Determine accessible extensions for
the given paths to pack roots. This includes machine learning models and
data extensions.
[Deep plumbing] Determine the extractor pack to use for a given
language.
[Deep plumbing] Expand a set of file inclusion/exclusion globs.
List installed CodeQL extractor packs.
[Deep plumbing] Determine QL library path and dbscheme for a query.
[Deep plumbing] Determine QL library paths and dbschemes for multiple
queries.
[Deep plumbing] Resolve and return the key-value metadata pairs from a
query source file.
[Deprecated] [Experimental] [Deep plumbing] Determine accessible
machine learning models.
Display a list of available CodeQL packs and their locations.
Create a list of installed QL packs and their locations.
[Deep plumbing] Dereferences a .qlref file to return a .ql one.
[Deep plumbing] Expand query directories and suite specifications.
[Deep plumbing] Prepare RAM options.
[Deep plumbing] Find QL unit tests in given directories.
[Deep plumbing] Determine upgrades to run for a raw dataset.
Accept results of failing unit tests.
[Plumbing] Build a dataset for a test directory.
Run unit tests for QL queries.
Show the version of the CodeQL toolchain.
Telemetry in CodeQL for Visual Studio Code
If VS Code telemetry is enabled, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
Problem with controller repository
If you see this warning, update your controller repository to a private repository.
Alerts found in generated code
When analyzing your code with code scanning, you may wish to build only the code which you wish to analyze.
Automatic build failed for a compiled language
If automatic build fails, you can configure code scanning to use specific build steps for compiled languages.
C# compiler unexpectedly failing
If your MSBuild C# compilation is unexpectedly failing, you may need to amend your application project file.
Cannot enable CodeQL in a private repository
GitHub Code Security must be enabled in order to use code scanning on private repositories.
Code scanning analysis takes too long
You can fine tune your code scanning configuration to minimize analysis time.
CodeQL scanned fewer lines than expected
If CodeQL analyzed less code than you expected, you may need to use a custom build command.
Enabling default setup takes too long
If you think that enabling default setup has stalled, you can restart the process.
If you see this error, make sure that GitHub Code Security is enabled.
"Out of disk" and "Out of memory" errors
If you see one of these errors with GitHub Actions, you can try alternative runners.
Error: 403 "Resource not accessible by integration"
This error may be seen on pull requests created by Dependabot and can be resolved in a couple of different ways.
Error: "is not a .ql file, .qls file, a directory, or a query pack specification"
CodeQL was unable to locate one of the queries or sets of queries that are specified for analysis.
Error: "No source code was seen during the build"
When CodeQL fails to find any source code, you need to resolve this problem to unblock code scanning analysis.
If you see this error, it may be transient. Check the current GitHub Actions service status, and try running your workflow again.
Extraction errors in the database
You can check whether or not extraction errors affect the health of the CodeQL database created.
Increase log verbosity and generate debugging artifacts when logs lack diagnostic detail.
Results are different than expected
If your code scanning results are different than you expected, you can check which configurations are active.
Some languages were not analyzed with CodeQL advanced setup
If some languages were not analyzed, you can modify your code scanning workflow to add a matrix specifying the languages you want to analyze.
If you see two workflows named "CodeQL", one workflow may be a pre-existing CodeQL workflow file which has been disabled by default setup.
Unclear what triggered a workflow run
If you don't know what triggered an analysis, investigate the tool status page or look at the log for the last scan.
Warning: "1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary"
If you see this warning, you should update your workflow to follow current best practice.
Warning: Detected X Kotlin files in your project that could not be processed without a build
CodeQL databases can be created for Java without building the code, but Kotlin files are excluded unless the code is built.
You can view the output generated during code scanning analysis in GitHub.
Automatic dependency submission
Network access requirements, troubleshooting, and ecosystem-specific behavior for automatic dependency submission.
Detailed information for all the options you can use to customize how Dependabot maintains your repositories.
Dependabot alerts filters help you prioritize and manage alerts for vulnerable dependencies in your repositories.
Supported ecosystems and manifests for dependency scope
Dependabot alerts supports a variety of ecosystems and manifests for dependency scope.
Dependabot pull request comment commands
Dependabot responds to commands in comments on its pull requests, making it easy to triage and manage dependency updates.
Dependabot supported ecosystems and repositories
Dependabot supports a variety of ecosystems and repositories
Dependabot security updates reference
Find usage information for Dependabot security updates.
Dependency graph supported package ecosystems
Dependency graph supports a variety of ecosystems.
Detailed information on using Dependabot with GitHub Actions.
CWEs used by GitHub's preset Dependabot rules
GitHub uses industry-standard criteria to help you filter Dependabot alerts.
Troubleshooting the dependency graph
If the dependency information reported by the dependency graph is not what you expected, there are a number of points to consider, and various things you can check.
Dependabot update pull requests no longer generated
Dependabot can pause updates based on your interaction with Dependabot pull requests. Learn more about the automatic deactivation of Dependabot updates.
Troubleshooting Dependabot on GitHub Actions
This article provides troubleshooting information for issues you may encounter when using Dependabot with GitHub Actions.
Vulnerable dependency detection
If the dependency information reported by GitHub is not what you expected, there are a number of points to consider, and various things you can check.
Dependabot automatically maintains your dependencies, keeping your code secure and current. This reference helps you diagnose and resolve issues so automated updates can continue.
Java package metadata for Dependabot updates
Include metadata in your pom.xml file to provide helpful links and context in Dependabot pull requests for Java package updates.
Understand the terminology used by GitHub to assess the quality of your repository's code.
Code Quality shows what percentage of the lines of your code your tests actually exercise, so you can find untested code before you merge.
CodeQL-powered analysis for Code Quality
Information on how CodeQL-powered analysis for Code Quality works, the workflow used, and the status checks reported on pull requests.
C# CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in C#.
Go CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in Go.
Java CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in Java.
JavaScript CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in JavaScript.
Python CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in Python.
Ruby CodeQL queries for Code Quality
Explore the queries that CodeQL uses to analyze code quality for code written in Ruby.
Repository security advisories
The actions you can take in a repository security advisory depend on whether you have admin or write permissions to the security advisory.
The actions you can take in security overview depend on your permissions for the repositories in your organization or enterprise.
Investigation tools for security incidents
The core GitHub tools you can use to investigate security incidents, what each tool is best used for, and common considerations that affect what data is available.
Common security incident investigation areas
Reference for investigating security incidents across multiple attack vectors, including the key surfaces and tools to check on GitHub.
Secure your secrets at scale with GitHub
Leaked credentials expose your organization to data breaches. GitHub Secret Protection detects and prevents secret leaks automatically. Follow this five-phase adoption path to assess your current risk, evaluate GitHub Secret Protection, run a pilot, monitor its value, and scale protection across your organization.
Improve code quality at scale with GitHub
Inconsistent code quality slows every team down and adds risk you can't easily see. GitHub Code Quality catches issues before they merge and reports on code health across your organization. Follow this adoption path to evaluate the feature, run a pilot, prove its value, and roll it out at scale.
Planning a trial of GitHub Advanced Security
Prepare your organization to evaluate Advanced Security against clear security and purchasing goals.
Setting up a trial of GitHub Advanced Security
Evaluate GitHub Code Security and GitHub Secret Protection on your existing repositories before you buy.
Enabling security features in your trial
Apply Secret Protection and Code Security to a sample of repositories so your team can evaluate the features during your trial.
Exploring your enterprise trial of GitHub Secret Protection
Introduction to the features available with GitHub Secret Protection in GitHub Enterprise Cloud so you can assess their fit to your business needs.
Exploring your enterprise trial of GitHub Code Security
Introduction to the features of code and dependency scanning available with GitHub Code Security in GitHub Enterprise Cloud so you can assess their fit to your business needs.
Best practices for preventing data leaks in your organization
Learn guidance and recommendations to help you avoid private or sensitive data present in your organization from being exposed.
Running a security campaign to fix alerts at scale
Launch a focused security campaign to remediate a specific class of security alerts, such as cross-site scripting (XSS), across your organization.
Prioritizing Dependabot and code scanning alerts using production context
Focus remediation on real risk by targeting Dependabot and code scanning alerts in artifacts deployed to production, using metadata from external systems and integrations like Dynatrace, JFrog Artifactory, Microsoft Defender for Cloud, or your own CI/CD workflows.
Interpreting secret risk assessment results
Understand the results from your secret risk assessment and prioritize leak remediation.
Interpreting code security risk assessment results
Understand the results from your code security risk assessment and prioritize vulnerability remediation.
Organizing remediation efforts for leaked secrets
Systematically organize and manage the remediation of leaked secrets using security campaigns and alert assignments.
Protecting against security threats
What steps should I take now, in the near future, and on an ongoing basis to reduce exposure to security threats across my organizations on GitHub?
Preparing for a security incident
Ensure you have the tools and processes in place to respond effectively to a security incident.
Responding to a security incident
Respond strategically to a security incident affecting organizations or repositories in your GitHub enterprise.
Calculating the cost savings of push protection
Estimate the remediation time and labor costs you'll avoid by preventing leaked secrets.
Assessing the impact of GitHub Secret Protection
Measure how GitHub Secret Protection reduces secret exposure across your organization, so you can demonstrate value and identify areas to strengthen your security posture.
Evaluating alerts from secret scanning
Learn about additional features that can help you evaluate alerts and prioritize their remediation, such as checking a secret's validity.
Remediating a leaked secret in your repository
Learn how to respond effectively to a leaked secret in your GitHub repository.
Secret scanning partner program
As a service provider, you can partner with GitHub to have your secret token formats secured through secret scanning, which searches for accidental commits of your secret format and can be sent to a service provider's verify endpoint.
Evaluating default setup for code scanning
Learn how to assess how code scanning is working for you, and how you can customize your setup to best meet your needs.
Preparing your code for CodeQL analysis
You can build a CodeQL database containing the data needed to analyze your code.
Analyzing your code with CodeQL queries
You can run queries against a CodeQL database extracted from a codebase.
Uploading CodeQL analysis results to GitHub
You can use the CodeQL CLI to upload CodeQL analysis results to GitHub.
Running CodeQL code scanning in a container
You can run code scanning in a container by ensuring that all processes run in the same container.
Customizing analysis with CodeQL packs
You can use CodeQL packs to run CodeQL queries maintained by other people, or to share CodeQL queries that you've developed.
You can create query suites for queries you frequently use in your CodeQL analyses.
Creating and working with CodeQL packs
You can use CodeQL packs to create, share, depend on, and run CodeQL queries and libraries.
Find and fix vulnerable dependencies you rely on with Dependabot.
Automating Dependabot with GitHub Actions
Examples of how you can use GitHub Actions to automate common Dependabot related tasks.
Optimizing the creation of pull requests for Dependabot version updates
Learn how to streamline and efficiently manage your Dependabot pull requests.
Setting up Dependabot to run on self-hosted action runners using the Actions Runner Controller
You can configure the Actions Runner Controller to run Dependabot on self-hosted runners.
Customizing Dependabot pull requests to fit your processes
Learn how to tailor your Dependabot pull requests to better suit your own internal workflows.
Customizing your dependency review action configuration
Learn how to add a basic customization to your dependency review action configuration.
Securing your end-to-end supply chain
Introducing best practice guides on complete end-to-end supply chain security including personal accounts, code, and build processes.
Best practices for securing accounts
Guidance on how to protect accounts with access to your software supply chain.
Best practices for securing code in your supply chain
Guidance on how to protect the center of your supply chain—the code you write and the code you depend on.
Best practices for securing your build system
Guidance on how to protect the end of your supply chain—the systems you use to build and distribute artifacts.
Prioritizing Dependabot alerts using metrics
You can prioritize Dependabot alerts in your organization by analyzing the provided metrics. Using this approach, you can tell your developers to focus on the most important vulnerabilities first.
Participating in a code security campaign
If you've been assigned alerts as part of a security campaign, this guide explains what campaigns are, what to expect, and how to resolve alerts effectively.
Preventing code quality issues from reaching your default branch
Move through Code Quality findings on your pull request, including understanding severity labels, when each finding is best fixed, delegated, or dismissed, and how those choices shape your repository's code health.
Raising your repository's code quality score
Prioritize and resolve the findings that pose the most risk, raise your repository's code quality score, and prevent new debt from accumulating.
Collaborating in a temporary private fork to resolve a repository security vulnerability
You can create a temporary private fork to privately collaborate on fixing a security vulnerability in your public repository.
Best practices for writing repository security advisories
When you create or edit security advisories, the information you provide is easier for other users to understand when you specify the ecosystem, package name, and affected versions using the standard formats.