Chapter 4 · Project Management and Security·v2.0.0·Updated 6/28/2026·~9 min
What's changed: Rewritten with structured blocks (diagrams, callouts, key points, quizzes)
4.2GitHub Security Features
Key points
Survey how GitHub protects code and the software supply chain: Code scanning for code, Secret scanning for secrets, Dependabot for dependencies, plus signed commits and audit logs at an awareness level.
GitHub provides features to protect code and the software supply chain (dependencies). Many are delivered as GitHub Advanced Security (GHAS) (in the 2025 repackaging, GHAS split into separately purchasable GitHub Secret Protection and GitHub Code Security products). Here, focus on "which feature protects what."
4.2.1Protect code and secrets
- Code scanning: statically analyzes code (e.g., with CodeQL) to find vulnerabilities and bugs. Results appear as alerts in the Security tab and can warn on PRs.
- Secret scanning: detects secrets like API keys/tokens in commits/pushes. With push protection, it blocks pushes containing secrets to prevent leaks up front.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.