According to GitHub's documentation, features available on all plans include the dependency graph, SBOM export, Dependabot alerts and updates, security advisories and rulesets. Code scanning, dependency review and Copilot Autofix need GitHub Code Security for private repositories. Secret scanning alerts and push protection need GitHub Secret Protection.
The three groups
Available on all plans: security policy, dependency graph, SBOM export as SPDX, GitHub Advisory Database, Dependabot alerts and security updates, Dependabot malware alerts, version updates, security advisories, repository rulesets, secret scanning alerts for partners and push protection for users on public repositories.
Requires GitHub Secret Protection: secret scanning alerts for users, AI detected secrets, push protection for repositories, delegated bypass, custom patterns and security overview.
Requires GitHub Code Security: code scanning, the CodeQL CLI, Copilot Autofix, AI Scan, custom auto-triage rules for Dependabot, dependency review and security campaigns.
What "free on public repositories" means
For several paid features, the documentation says they are available for public repositories by default. That covers code scanning, the CodeQL CLI, Copilot Autofix, dependency review, secret scanning alerts and push protection on public repositories. Private and internal repositories are where the add-ons apply.
A table to take into a buying discussion
| Need | Built in, all plans | Add-on needed for private repos |
|---|---|---|
| Know your dependencies | Dependency graph, SBOM export | No |
| Alerts for vulnerable packages | Dependabot alerts | No |
| Automatic fix pull requests for dependencies | Dependabot security updates | No |
| Static code analysis | No | Code scanning |
| Secret detection | Partner alerts | User alerts, push protection |
| Block risky dependency changes | No | Dependency review |
| Org wide dashboard | No | Security overview |
Plan names and bundles change, so verify them on the live page before you sign anything. The page also notes artifact attestations on Free, Pro and Team plans apply to public repositories, with private or internal ones requiring GitHub Enterprise Cloud.
Questions to ask about coverage, not cost
- Which of our repositories are private or internal?
- Which languages are outside CodeQL support?
- Do we need one view across non GitHub repositories?
- Who triages the alerts, and how fast?
Features that exist but are not enabled protect nothing. Check the coverage view before treating a feature as in place.
Where a dedicated scanner fits
If part of your code is on another host, or you want reachability analysis and policy gates across all of it, a separate platform can be the common layer. Safeguard offers SBOM and dependency scanning, policies and gates, and a free scan at gold.safeguard.sh/scan.
Quick check
Is the dependency graph free on private repositories?
The documentation lists the dependency graph as available for all GitHub plans.
Does a public repository get code scanning without an add-on?
Yes. The documentation says code scanning is available for public repositories by default.
Sources
- GitHub Docs: GitHub security features
- GitHub Docs: About secret scanning
- GitHub Docs: About code scanning
Last reviewed: 19 October 2026.
