What's changed: New GH-500 Chapter 1 (suites & architecture = three pillars Code Security/Secret Protection/Supply Chain, former names, public vs enterprise availability and licensing, Security Overview; secure SDLC & alert strategy = prevention-first vs gate-based, security campaigns, detect/manage/respond, roles [developer/security manager/admin], dismissal practice, delegated bypass and enforcement)
1.1GitHub Security Suites and Architecture
Understand the structure and navigation of GitHub Security suites; the differences among Code Security, Secret Protection, and Supply Chain Security; feature availability for public repos vs enterprise; and the features and benefits of the Security Overview.
GitHub Advanced Security (GHAS) is a set of features that protect code, secrets, and dependencies across the software development lifecycle (SDLC). GH-500 first establishes that these are organized into three pillars—Code Security (finds code vulnerabilities), Secret Protection (finds/prevents leaked secrets), and Supply Chain Security (handles dependency risk).
1.1.1The three pillars and their differences
Code Security (the product bundling code scanning / CodeQL) statically analyzes source code to detect vulnerabilities like SQL injection or path traversal. Secret Protection (the product bundling secret scanning / Push Protection) detects/blocks secrets committed or about to be committed (API keys, tokens). Supply Chain Security (the dependency graph / Dependabot / Dependency Review; its paid features are part of Code Security) finds known vulnerabilities in dependencies via the dependency graph and Dependabot, prompting updates. The three target different things (your code / secrets / others’ dependencies) and combine for layered defense.
| Pillar | Target | Bundled feature |
|---|---|---|
| Code Security | Vulnerabilities in your code | Code Scanning (CodeQL) |
| Secret Protection | Leaked/about-to-leak secrets | secret scanning |
| Supply Chain | Vulnerabilities in dependencies | Dependabot / Dependency Review |
1.1.2Public repos vs enterprise availability
Feature availability differs by environment. On public repositories, many features (code scanning, secret scanning) are free. To use the full set on private repos or enterprise, a Secret Protection / Code Security license (the individual products split out of GHAS in 2025) is required. The exam tests the "free on public, licensed on private/enterprise" line, and that GitHub Enterprise Cloud vs Server have feature differences.
1.1.3The Security Overview
The Security Overview is a dashboard giving an at-a-glance view of security posture across an org or repository. It aggregates which repos have features enabled, how many open alerts exist, and risk trends, aiding prioritization and coverage checks. It’s the starting point for admins/security staff to decide "where to begin."
Common: (1) GHAS three pillars = Code Security (your code) / Secret Protection (secrets) / Supply Chain (dependencies); know the features each bundles (code scanning / secret scanning / Dependabot & Dependency Review), whose names remain current. (2) Availability = free for many features on public repos; GHAS license on private/enterprise; Cloud vs Server differ. (3) Use the Security Overview for org-wide posture and prioritization.
Watch out: (1) Code Security (your code), Secret Protection (secrets), and Supply Chain (dependency vulns) target different things—don’t conflate roles. (2) Don’t mix up "free on public" with "license required on private/enterprise." (3) Products bundle features (Secret Protection includes secret scanning, etc.); the feature names code scanning/secret scanning remain current—not renames. (4) Security Overview is for visibility/prioritization, not performing remediation itself.
1.1.4Section summary
- Three pillars = Code Security (your code) / Secret Protection (secrets) / Supply Chain (dependencies)
- Availability: free for many features on public; GHAS license on private/enterprise; Cloud vs Server differ
- Use Security Overview for org-wide posture and prioritization
- Bundled features: Secret Protection = secret scanning/Push Protection, Code Security = code scanning/CodeQL, Supply Chain = dependency graph/Dependabot/Dependency Review (feature names remain current)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which GHAS feature statically analyzes source code to detect vulnerabilities like SQL injection?
Q2. Which feature detects/blocks API keys or tokens committed or about to be committed?
Q3. Which pillar handles known vulnerabilities in dependencies via the dependency graph and Dependabot?
Q4. What is generally required to use the full set of GHAS features on private repos or enterprise?
Q5. Which dashboard gives an at-a-glance view of security posture across an org/repo to aid prioritization?
Q6. Which is correct about GHAS feature availability on public repositories?