You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert

GitHub Code Security

Secure your code as you build with GitHub Code Security. Detect vulnerabilities early and fix them with Copilot Autofix.

Request a demo See plans & pricing

What is GitHub code security?

28 min From vulnerability detection to remediation

3X Faster remediation on average with Copilot Autofix

90% Of alert types include AI-powered code suggestions

Find security issues in real time with CodeQL’s powerful analysis that traces data flows throughout your application.

![The image displays a code snippet from a JavaScript file named "collection.js" located in the "routes" directory. The code is highlighted in three steps, with Step 1 being the focus. In Step 1, the variable "jsonQuery" is assigned the value of "req.query.query". The code snippet includes four lines where variables are defined and assigned values from the request query object. The background has a gradient blue color.

](https://images.ctfassets.net/8aevphvgewt8/5tcgOQ47ZVKtlS5ZLQTfSc/a082c5b055f4dcf4fbbce9d784fb421a/Image_Area__60_40__6.webp?w=720&fm=webp&q=90)

Get contextual explanations and AI-powered fixes for CodeQL-detected alerts with Copilot Autofix.

![The image displays a code snippet from a JavaScript file named "collection.js" located in the "routes" directory. The code is highlighted in three steps, with Step 1 being the focus. In Step 1, the variable "jsonQuery" is assigned the value of "req.query.query". The code snippet includes four lines where variables are defined and assigned values from the request query object. The background has a gradient blue color.

](https://images.ctfassets.net/8aevphvgewt8/UxNESVIVzwNkprfGDdbD9/09abcffcc719758be0ef2289d6b0009b/Image_Area__60_40__7.webp?w=720&fm=webp&q=90)

GitHub Code Security continuously scans your code as you build, helping detect vulnerabilities early, fix them fast with Copilot Autofix, and ship securely.

![The image displays a dashboard for an SQL injection (CWE-89) campaign aimed at remediating Cross-Site Scripting (XSS) vulnerabilities. The dashboard has three main sections: Campaign progress, Status, and Copilot Autofix.

In the Campaign progress section, it shows 97% completion with 701 alerts, where 701 are closed and 13 are in progress. It also notes that the campaign started 20 days ago.

The Status section indicates there are 7 days left until the deadline on November 15, 2024.

The Copilot Autofix section mentions that there are 670 supported alerts and provides information about how Copilot Autofix can help fix these alerts automatically.](https://images.ctfassets.net/8aevphvgewt8/3XtStULvvadAF4bh8QBOHc/df209619dbd649d798f086b7b271197b/Image_Area__60_40__8.webp?w=720&fm=webp&q=90)

Identify new dependencies and check for vulnerabilities or license issues with the Dependency Review Action.

Evaluate exposure to application vulnerabilities and leaked secrets in your codebase with our free risk assessment tool.

Mario Landgrafcommunity manager of security at Otto GmbH & Co. KGaA

Security should be built in, not bolted on. With Code Security, you can find, fix, and prevent vulnerabilities seamlessly—keeping your software resilient from development to deployment.

Request a demo See plans & pricing

Take an in-depth look at the current state of application security.

View the webinar

Learn how to write more secure code from the start with DevSecOps.

Read the whitepaper

Explore common application security pitfalls and how to avoid them.

Read the whitepaper

GitHub Code Security empowers developers to secure their code without sacrificing speed. With built-in static analysis, AI-powered remediation, advanced dependency scanning, and proactive vulnerability management, teams can automatically detect, prioritize, and remediate security issues, all within their existing GitHub workflow—allowing them to deliver secure software faster and with greater confidence

Copilot Autofix uses AI-powered code suggestions to automatically fix security vulnerabilities identified by CodeQL. When a security vulnerability is detected, Copilot Autofix analyzes the code context, understands the underlying security issue, and generates a precise, contextually appropriate fix. This feature bridges the gap between vulnerability detection and remediation, enabling developers to review and apply AI-suggested fixes directly within their workflow.

Security campaigns provide a structured framework for planning, tracking, and implementing security fixes across multiple repositories and teams allowing you to systematically burn down security debt. With With security campaigns, security teams can group related vulnerabilities, prioritize remediation efforts, assign ownership, and monitor progress through a unified dashboard. Security campaigns can be organized by vulnerability type, security initiative, compliance requirement, or any other logical grouping to coordinate security improvements at scale.

Dependency review scans pull requests for vulnerable dependencies before they're introduced into your codebase. It evaluates the security impact of dependency changes, identifying vulnerable packages and their severity levels to prevent security issues from being merged. The tool shows detailed dependency changes by comparing the base and head branches, highlighting added, removed, and updated dependencies along with their known vulnerabilities

Dependabot alerts now feature the Exploit Prediction Scoring System (EPSS) from the global Forum of Incident Response and Security Teams (FIRST), helping better assess vulnerability risks. EPSS helps organizations prioritize vulnerability remediation by predicting the likelihood of a vulnerability being exploited in the next 30 days. It provides a score ranging from 0 to 1 (0-100%), alongside a percentile ranking to indicate how the vulnerability compares to others.

The Code Security Risk Assessment is a free evaluation that analyzes repositories to identify potential code-level vulnerabilities and highlight areas where GitHub Code Security can help improve security posture. Learn more about GitHub security risk assessments .

You can’t perform that action at this time.