How Exposed Is Your Code? Find Out for Free in Minutes

Code Security Risk Assessment scans up to 20 of an organization's most active repositories with CodeQL, surfacing hidden vulnerabilities in minutes.

The dashboard lets you check the following at a glance:

• Total vulnerability counts by severity, including critical / high / medium / low
• Vulnerability distribution by language
• Detected rules and the number of affected repositories
• Priority ranking of the most vulnerable repositories
• Number of vulnerabilities that can be auto-fixed with Copilot Autofix

This feature is available to organization admins and security managers on GitHub Enterprise Cloud and GitHub Team plans. There is no license cost, and the GitHub Actions minutes used for scanning don't count against your quota.

It works alongside the existing Secret Risk Assessment from a single entry point, with tabs to switch between secret exposure and code vulnerability results. GitHub states that as of 2025, Secret Protection has scanned nearly 2 billion pushes and blocked 19 million secret exposures.

The automation impact is also significant on the code security side. Across all of GitHub in 2025, 460,258 security alerts were fixed with Copilot Autofix, and 50% of vulnerabilities were resolved within pull requests developers were already working on. The average remediation time was 0.66 hours for automated fixes versus 1.29 hours for manual fixes—nearly twice as fast.

Ultimately, this tool serves as a quick starting point that organizations "without security scanning," "reviewing their existing tools," or "wanting a broader view of company-wide risk" can all begin using for free. From the results page, you can activate Code Security directly, connecting discovery to remediation.