GitHub security overview is an organization level dashboard of active security alerts and feature adoption across repositories. Its risk view shows where exposure is concentrated, and its coverage view shows which repositories have security features turned on. Full views need GitHub Secret Protection or Code Security.
What it shows
The GitHub documentation says security overview shows active alerts from security features, and only for the default branches of repositories you can view. It reaches organization and enterprise level. Organization owners and security managers see every repository, while members see repositories where they can access alerts.
The main views
| View | Question it answers |
|---|---|
| Overview | Are detection, remediation and prevention trends improving? |
| Risk | Where is exposure concentrated, by alert type or across all? |
| Coverage | Which repositories have security features enabled? |
| Assessments | Are there leaked secrets? A free one time scan |
| Campaigns | Who owns grouped fixes and how far along are they? |
| Enablement | How quickly are teams adopting features? |
| Dependabot | Which critical dependency alerts need attention? |
| Secret scanning | Which secret types does push protection block, and who bypasses it? |
Risk and coverage are different questions
Risk looks at alerts that exist. Coverage looks at protection that is turned on. A repository with no alerts may have no coverage at all, and the documentation says so directly: a repository with no alerts may still have undetected vulnerabilities, or the feature may not be enabled there. Reading risk without coverage can lead to false comfort.
Caveats from the documentation
- Alert data covers default branches only.
- Repository filters reflect current state while alert data reflects history, so past dashboard figures can change over time.
- For consistent compliance reporting, GitHub recommends the audit log.
- Data can be exported as CSV.
- Some views and actions depend on role.
How a security lead can use it
- Start with coverage. List repositories with no scanning enabled.
- Turn features on where gaps exist, then recheck.
- Move to risk and sort by alert type.
- Create a campaign for the highest concentration and give it an owner.
- Export a monthly CSV and keep it with your evidence.
Where a dedicated scanner fits
Security overview covers GitHub. If your code also lives elsewhere, you need another place to see it together. Safeguard provides asset discovery, vulnerability management and compliance and evidence automation, and a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings change over time, and ask which repositories would never appear in a view like this.
Quick check
Does security overview include non default branches?
No. The documentation says it shows alerts for default branches only.
Is there a free part of security overview?
The free secret risk assessment is available to organizations on GitHub Team. The full set of views needs Secret Protection or Code Security.
Sources
Last reviewed: 19 October 2026.
