GitHub Docs: Security and code quality

What it is

GitHub's security documentation explains the security tools built into every GitHub repository. For a student, it is the quickest way to add real application security practice to projects you already have, without installing anything. The main areas are:

• Supply chain security: the dependency graph, Dependabot alerts for dependencies with known vulnerabilities, Dependabot security updates that open pull requests to fix them, Dependabot version updates, and dependency review on pull requests.
• Secret security: secret scanning, which detects credentials committed to a repository, and push protection, which blocks a push that contains a detected secret before it lands.
• Code scanning: automated analysis of your code for vulnerabilities and coding errors, most commonly with GitHub's CodeQL engine, with results shown as alerts on the repository and on pull requests.

What is free

As of 2026-09, GitHub's "GitHub security features" page says Dependabot alerts, Dependabot security and version updates, and the dependency graph are available for all repositories. Secret scanning alerts, push protection, code scanning, the CodeQL CLI and dependency review are "available for public repositories by default". Using those features on private repositories in organisations requires the paid GitHub Secret Protection or GitHub Code Security products. Push protection for users, which stops you pushing secrets to public repositories, is enabled by default on personal accounts. GitHub changes plans from time to time, so check the feature availability page.

How to use it on your own project

Pick one public repository you own. Turn on Dependabot alerts and security updates, then set up code scanning with the default CodeQL setup, which needs no workflow file for supported languages. Read the first alerts carefully: some will be real, some will be noise, and learning to tell the difference is the actual skill. Merge a Dependabot pull request and check that your tests still pass.

Time needed and prerequisites

Basic Git and GitHub knowledge is enough. Enabling the features takes minutes; understanding and fixing the first batch of alerts takes an evening or two.

Why it is worth it

Application security is increasingly part of every developer's job rather than a separate team's. A repository with dependency updates, secret scanning and code scanning switched on, plus a SECURITY.md explaining how to report problems, shows an employer you think about security as part of building software. It also pairs naturally with tools like Semgrep, Gitleaks and Trivy, which you can run locally or in the same CI.

Common questions

Do I need GitHub Advanced Security as a student? Not for public repositories. The core features above are free there.

Does code scanning replace code review? No. It catches known patterns; logic flaws still need a human.

What if a secret is already in my history? Rotate it at the provider first. Removing it from history is secondary, because anyone may already have copied it.