GitHub Advanced Security Explained: Secret Protection, Code Security, CodeQL, Push Protection and Dependabot

For many companies, GitHub's own security features are the first code security tools they turn on, because they are already inside the platform where code lives. Interviewers like them as a topic because the hard part is not switching them on; it is rolling them out across thousands of repositories without drowning developers or letting secrets through.

What it is

Since 1 April 2025, what used to be sold as GitHub Advanced Security (GHAS) is two products, priced per active committer:

• GitHub Secret Protection: secret scanning, push protection, custom patterns, AI-detected secrets, and governance of bypasses and dismissals.
• GitHub Code Security: code scanning with CodeQL (and third-party tools through SARIF uploads), Copilot Autofix, security campaigns, dependency review and the security overview.

Dependabot alerts and security updates can be turned on for any repository; Code Security adds some Dependabot features, such as custom auto-triage rules on private repositories. Secret scanning is free on public repositories; private and internal repositories in organisations need Secret Protection.

How it works

CodeQL builds a database that represents the code, then runs queries against it; results become code scanning alerts. Default setup lets GitHub choose languages, the query suite and triggers, and needs GitHub Actions enabled. Advanced setup is a workflow you own, using github/codeql-action, which you need for custom queries, the security-and-quality suite or unusual builds. CodeQL does not support PHP or Scala; GitHub's AI Scan for pull requests, generally available since 15 October 2026, adds model-based detections for languages and files CodeQL does not cover, such as PHP, shell scripts, Terraform and Dockerfiles.

Secret scanning checks the full git history on every branch, plus issues, pull request text, discussions and wikis. Matches for partner token formats are reported to the issuing provider, and validity checks can ask the provider whether a token is still live. Push protection stops a push that contains a supported secret, through the command line, web edits, uploads and the REST API.

Dependabot raises alerts when the dependency graph contains a vulnerable version, can open security update pull requests, and is configured with .github/dependabot.yml. Dependency review (actions/dependency-review-action) fails a pull request that adds a vulnerable dependency or a disallowed licence.

How to use it

Day one: enable it as configuration, not repository by repository

Create an organisation security configuration that turns on the dependency graph, Dependabot alerts, secret scanning with push protection, and CodeQL default setup, and apply it to all repositories. Before enforcing anything, read the coverage view in the security overview to see which repositories failed to enable, usually because Actions is disabled or the language is unsupported.

Week one: triage and decide on bypass

1. Secrets first. Sort secret alerts by validity. A live cloud key in history is an incident: revoke and rotate it, then decide whether to rewrite history. Deleting the commit does not revoke the key.
2. Decide who can bypass push protection. For most organisations, turn on delegated bypass for repositories holding production code: a named bypass list (security team, selected roles) approves requests, and automation accounts that legitimately handle test fixtures can be exempted.
3. Add custom patterns for internal token formats. Up to 500 per organisation are allowed, and they only block pushes once you enable push protection for them.
4. Tune CodeQL noise by suite: start with default, and move to security-extended where teams have capacity.

Every day: make the checks matter

Use repository rulesets to require code scanning results and dependency review on protected branches; until a check is required, it is only advice. Pin third-party actions to full commit SHAs: in March 2026 the attacker behind the Trivy compromise force-pushed most of the trivy-action release tags, so every workflow that referenced a tag ran malicious code. Use security campaigns to work through a backlog with named owners and deadlines, with Copilot Autofix proposing patches that developers review.

Where it stops

• Push protection only knows supported patterns. A password in a config file with no recognisable format may need AI detection or a custom pattern, and the coverage differs by push route.
• Autofix is not deterministic. GitHub's responsible-use page warns that suggestions can change behaviour, break syntax, or suggest dependencies that are "insecure or fabricated".
• AI Scan is advisory. It cannot fail a check or block a merge.
• Coverage is per repository. A repository where Actions is disabled has no CodeQL default setup, and the security overview shows only default branches.

How it comes up in interviews

• "Roll out push protection to 3,000 repositories without a revolt." Talk about measuring first, delegated bypass, custom patterns, exemptions for automation and a feedback loop for false positives.
• "A developer bypassed push protection with 'I'll fix it later'. What happens next?" The alert stays open; someone must rotate the secret, and bypass metrics belong in the security overview.
• "Why pin actions to a commit SHA?" Tags are mutable, and the 2026 Trivy compromise showed what happens when they move.

Sources

Checked on 13 November 2026: GitHub changelog (4 March 2025, introducing Secret Protection and Code Security; 1 April 2025 Enterprise availability; 15 October 2026, AI Scan for pull requests generally available); GitHub Docs on CodeQL code scanning, default and advanced setup, query suites, secret scanning, push protection, custom patterns, delegated bypass, Dependabot security updates, security campaigns, security overview and responsible use of Copilot Autofix; actions/dependency-review-action README; GitHub advisory GHSA-69fq-xp46-6x23 for the Trivy compromise.