SAST tools › GitHub Advanced Security pricing
GitHub Advanced Security pricing: what you pay per committer
GitHub Advanced Security is sold as two add-ons: Code Security at $30 and Secret Protection at $19 per active committer a month, $49 for both. You pay them on top of GitHub Team ($4 a user) or Enterprise ($21 a user). Public repositories get code scanning, secret scanning and dependency review free, and the new AI features are metered in AI credits at $0.01 each.
What each add-on includes
| Code Security | Secret Protection | |
|---|---|---|
| Price | $30 per active committer a month | $19 per active committer a month |
| Main features | CodeQL code scanning, Copilot Autofix, dependency review, premium Dependabot features, security campaigns, SARIF upload from other scanners | Secret scanning across git history, pull requests, issues and wikis; push protection; validity checks; AI-detected passwords; custom patterns |
| Metered extras (AI credits) | AI Scan for pull requests and repositories, agentic autofix | AI-detected secrets in push protection |
| Free on public repositories | Code scanning, Copilot Autofix, dependency review | Secret scanning, push protection |
Dependabot security updates and version updates are included on every GitHub plan, Free too, so basic dependency alerts don't need either add-on.
Worked out for 5, 25 and 100 committers
A month at list price, assuming every user is also an active committer:
| Committers | Code Security | Both add-ons | Both + GitHub Team | Both + GitHub Enterprise |
|---|---|---|---|---|
| 5 | 5 × $30 = $150 | 5 × $49 = $245 | $245 + $20 = $265 | $245 + $105 = $350 |
| 25 | $750 | $1,225 | $1,225 + $100 = $1,325 | $1,225 + $525 = $1,750 |
| 100 | $3,000 | $4,900 | $4,900 + $400 = $5,300 | $4,900 + $2,100 = $7,000 |
The add-ons count committers, not seats, so the real bill is often lower. A 25-person organization where 18 people pushed code in the last 90 days pays Code Security for 18: 18 × $30 = $540, not $750.
Who counts as an active committer
- Anyone whose commit was pushed, in the last 90 days, to a repository with Code Security or Secret Protection turned on, whenever the commit was written.
- They must hold a GitHub Team or Enterprise license with your organization: members, managed users, outside collaborators and pending invitees all count.
- Each person uses one license however many repositories they push to. GitHub App bots are ignored.
- Turning a feature off for a repository frees the licenses of people who only committed there.
On volume billing you buy a set number of licenses; if active committers pass it, existing repositories keep working but you can't enable the features on new ones. On metered billing (GitHub Enterprise Cloud) you're billed monthly for what you used.
The AI credits on top
AI Scan for pull requests, AI Scan for repositories and agentic autofix consume Code Security AI credits, even on public repositories that don't need licenses; push protection for AI-detected secrets consumes Secret Protection AI credits, charged by how much content each push scans. GitHub's Copilot billing page sets 1 AI credit at $0.01. Included credits from a Copilot plan are used first, then usage is metered, and GitHub's docs advise setting a hard budget before turning these on widely. Classic Copilot Autofix doesn't use AI credits.
When CodeQL is free
On GitHub, CodeQL code scanning is free for public repositories. Outside GitHub's hosted scanning, the CodeQL CLI's terms allow academic research, demonstrations and analysis of open-source codebases under an OSI-approved license, and nothing else, so running the CLI over private company code needs a license. For a free scanner on private code, look at Semgrep's Free plan (up to 10 contributors) or the tools in open-source SAST tools.
Is it worth it?
For a team already on GitHub, $49 per committer buys the deepest GitHub-native SAST plus the strongest secret protection you can get without another vendor: push protection stops keys before they land. The comparisons that matter:
- Semgrep charges $30 for Code and $15 for Secrets per contributor, $45 together, works on GitLab, Bitbucket and Azure DevOps too, and is free up to 10 contributors.
- Snyk Team is $25 per developer for 5 to 10 developers and includes dependency scanning.
- Secrets only? Secret Protection at $19 alone is a reasonable buy; secret scanning tools compares it with Gitleaks, TruffleHog and GitGuardian.
- IonWarp, an AI pull-request reviewer for GitHub, is $49 a month for a 5-seat workspace; its Security Review reads the pull requests that touch auth, input, data access or secrets for logic and auth flaws. It doesn't scan git history for secrets, has no push protection and no dependency scanning, so it adds to Code Security rather than replacing it. Visit IonWarp
GitHub security plans · GitHub Advanced Security billing docs
Questions
Is GitHub Advanced Security free?
On public repositories, partly: code scanning with CodeQL, secret scanning and dependency review are free there. Private repositories need paid licenses: Code Security at $30 and Secret Protection at $19 per active committer a month, on a GitHub Team or Enterprise plan.
Is CodeQL free?
For public repositories on GitHub, academic research and analysis of open-source codebases, yes. The CodeQL CLI's terms don't allow other uses, such as scanning a company's private code, without a license, which in practice means GitHub Code Security.
How much does GitHub Advanced Security cost for 25 developers?
If all 25 commit in a 90-day window: Code Security is 25 × $30 = $750 a month, Secret Protection 25 × $19 = $475, so $1,225 for both, plus the GitHub plan itself: $100 a month on Team or $525 on Enterprise.
Related
- Secret scanning tools: Secret Protection against the free and paid alternatives.
- Open-source SAST tools: what to run on private code for free.
About this page
Published by Winding AI, Inc., the company that makes IonWarp, an AI pull-request reviewer for GitHub. We earn nothing from links to other tools; links to IonWarp carry a tag so IonWarp can count visits from this site. Visits are counted with Google Analytics. If a price or fact here is wrong, write to support@winding.ai.