What you are evaluating
Do not assume one license covers secrets and code. Secret push protection and branch protection are distinct controls. Committer metering and languages outside CodeQL are separate tests. Public-repository entitlements do not automatically apply to private repositories.
A useful evaluation context
A plausible evaluation context is a GitHub organization that must meter committers, split code and secret SKUs, and test languages that may fall outside CodeQL.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- GitHub Code Security: code scanning, dependency review, additional Dependabot capabilities, and Copilot Autofix on entitled repositories.
- GitHub Secret Protection: secret scanning, push protection, and custom patterns as a distinct SKU.
- Free availability of several features on public repositories, with Team or Enterprise required to buy the SKUs for private and internal repositories.
Where it fits in the work
- Inventory whether each repository is public, private, or internal, and purchase Code Security, Secret Protection, both, or neither accordingly.
- Enable code scanning and dependency review on a lab repository. Enable push protection separately from branch protection, using a vendor-supported safe secret pattern or a configured custom pattern that has no real access.
- Use branch rules to require scan status before merging; enabled push protection evaluates supported secret patterns before accepting pushes. Retain alerts as review evidence.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In a private lab repository, enable the Code Security and Secret Protection features you are entitled to test. Seed a supported CodeQL flaw, a vulnerable dependency, and a vendor-approved nonfunctional secret pattern or configured synthetic custom pattern. Never use a live credential.
Evidence to look for
The applicable code scan and dependency review report the selected issues. Enabled push protection handles the supported test pattern as configured. Record unsupported patterns, validity-check behavior, bypass permissions, and missing entitlements separately; arbitrary fake tokens need not trigger detection.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which repositories need Code Security, Secret Protection, both, or only public-repository defaults?
- How is committer metering calculated across the organization, including bots and outside collaborators?
- Which languages lack CodeQL coverage, and what alternative scanning is required?
Names you may encounter: GitHub Advanced Security · GitHub Code Security · GitHub Secret Protection. Historical names do not establish current availability or feature equivalence.