SECURITY ATLAS / EVALUATION BRIEF
GitHub Code Security and GitHub Secret Protection
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/github-advanced-security/

THE ATLAS TAKE
GitHub Code Security and Secret Protection integrate security checks into a repository platform many developers already use. The separate products address different work: code and dependency review versus secret detection and push protection. Atlas analysis: proximity to a pull request can reduce handoff friction, but only if features are enabled across the intended repositories and the right build or analysis path runs. Treat secret exposure as credential remediation, not just alert closure. Supported patterns, bypass authority, language support, and active-committer billing all deserve explicit verification before broad enablement.

SCOPE
Do not assume one license covers secrets and code. Secret push protection and branch protection are distinct controls. Committer metering and languages outside CodeQL are separate tests. Public-repository entitlements do not automatically apply to private repositories.

WORTH A LOOK WHEN
Organizations standardizing development on GitHub and wanting repository-native security feedback and remediation campaigns.

THINK TWICE WHEN
The requirement spans unsupported code hosts or assumes secret-alert dismissal invalidates the exposed credential.

IMPLEMENTATION
1. Inventory repository coverage
Map owned repositories, languages, required builds, and enabled security products.

2. Set exception authority
Define who can bypass protection, dismiss alerts, and approve time-bound code risk.

3. Connect secret response
Assign credential rotation and downstream invalidation tasks separately from removing the code.

OPERATING REALITY
Repository coverage, CodeQL or selected scanner configuration, alert ownership, and secret bypass rules need regular review. Atlas analysis: a useful rollout starts with known owners and a measured backlog. A check appearing on one pull request does not prove branch, language, or organization-wide coverage.

COMMERCIAL CONSIDERATIONS
Model Code Security and Secret Protection separately using the documented active-committer rules and actual enabled repository population.
- Unique active committers for enabled products
- Code Security versus Secret Protection scope
- Runner, analysis, and remediation operating effort

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Check a supported secret
Acceptance evidence: Use an approved inactive test pattern and retain blocking, bypass, and alert evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Prove code-scan coverage
Acceptance evidence: Show the intended language and build were analyzed on the exact pull-request revision.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Complete credential remediation
Acceptance evidence: Demonstrate rotation and failed use of the old lab credential, then close the repository alert.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which repositories need Code Security, Secret Protection, both, or only public-repository defaults?
- How is committer metering calculated across the organization, including bots and outside collaborators?
- Which languages lack CodeQL coverage, and what alternative scanning is required?

EVIDENCE GAPS
- No independent benchmark of CodeQL or secret-detection quality was performed.
- Enterprise Server deployment differences and current feature availability require confirmation.

SOURCES
GitHub Advanced Security products (Documentation)
https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
Advanced Security license billing (Pricing)
https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security
Supported secret scanning patterns (Documentation)
https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.