GitHub code scanning

Finding insecure patterns in a repository's code with CodeQL, especially on a public GitHub repo.

Last updated 2026-10-13

Free tierCode scanning

Free tier: Yes
Checked: 2026-10-13
Site: https://docs.github.com/en/code-security/getting-started/github-security-features

What the public pages say

Code scanning is worth enabling on a public repository before you invite users. It looks at code paths. It will not see a Supabase policy that lives only in the dashboard and was never committed.

For a private repository, budget for GitHub Code Security or use a scanner with a free private tier, and check that product's current plan.

Free tier

GitHub's security features page says code scanning and the CodeQL CLI are available for public repositories by default. Private repositories need GitHub Code Security. Copilot Autofix for code scanning alerts is also listed as available for public repositories by default.

Not stated on the vendor's site

Language coverage and which queries run by default. Read the current code scanning docs for the language list.

Sources

https://docs.github.com/en/code-security/getting-started/github-security-features

Markdown version · Canonical page: https://shipsecurely.dev/tools/github-code-scanning