---
name: GitHub code scanning
slug: github-code-scanning
url: https://docs.github.com/en/code-security/getting-started/github-security-features
category: Code scanning
bestFor: "Finding insecure patterns in a repository's code with CodeQL, especially on a public GitHub repo."
freeTier: yes
price: "Free for public repos"
checks:
  - source
freeTierNote: "GitHub's security features page says code scanning and the CodeQL CLI are available for public repositories by default. Private repositories need GitHub Code Security. Copilot Autofix for code scanning alerts is also listed as available for public repositories by default."
verifiedOn: "2026-10-13"
sources:
  - https://docs.github.com/en/code-security/getting-started/github-security-features
unknowns:
  - "Language coverage and which queries run by default. Read the current code scanning docs for the language list."
---

Code scanning is worth enabling on a public repository before you invite users. It looks at code paths. It will not see a Supabase policy that lives only in the dashboard and was never committed.

For a private repository, budget for GitHub Code Security or use a scanner with a free private tier, and check that product's current plan.