GitHub Code Security review

GitHub Code Security is the natural choice for teams already on GitHub because code scanning appears in the pull request without connecting another vendor. It runs CodeQL, GitHub's semantic analysis engine, and Copilot Autofix suggests fixes with explanations for CodeQL alerts in pull requests and in the backlog. Agentic autofix can open pull requests for up to 25 alerts at a time, an AI scan for pull requests covers languages CodeQL does not support, and security campaigns help a team work through old findings. The product costs $30 per active committer per month and is sold as an add-on to GitHub Team or Enterprise, with Team listed at $4 per user a month. That makes it pricier per head than Codacy or Snyk's entry plan, and the AI scans draw on AI credits. It also does nothing for code on GitLab, Bitbucket or Azure DevOps. Public repositories get CodeQL and Copilot Autofix free.

Who it is for

Teams whose code already lives on GitHub Team or Enterprise

Price

$30 per active committer per month; CodeQL code scanning is free for public repositories.

GitHub Code Security For teams and organizations committed to fixing vulnerabilities before production. $ 30 USD per active committer/month
Quoted from the vendor pricing page on November 12, 2026.

Key features

• CodeQL semantic code analysis on every repository
• Copilot Autofix suggests fixes, with explanations, for CodeQL alerts in pull requests and the backlog
• Agentic autofix can turn up to 25 code scanning alerts into pull requests
• AI scan for pull requests covers languages CodeQL does not, using AI credits
• Security campaigns to burn down the existing security backlog

Strengths and weaknesses

• Strength: Runs inside GitHub pull requests with no separate tool to connect
• Strength: CodeQL and Copilot Autofix are free on public repositories
• Strength: Billing counts only active committers
• Weakness: Works only for code hosted on GitHub
• Weakness: Requires a paid GitHub plan, with Team listed at $4 per user a month
• Weakness: AI scans for pull requests and repositories consume AI credits on top of the seat price

Key facts

• Price: $30 per active committer a month
• Engine: CodeQL, plus AI scans
• Free option: Public repositories

Where it ranks

GitHub Code Security is No. 3 in our Best Static Code Analysis Tools verdict.