How exposed is your code? Find out in minutes—for free (opens in new tab)

GitHub’s Code Security Risk Assessment offers organizations a free, one-click way to uncover vulnerabilities that manual reviews and limited scanning tools may miss. Using CodeQL, it scans up to 20 active repositories and provides a prioritized view of risks by severity, language, repository, and vulnerability type. The assessment also connects findings to GitHub Code Security and Copilot Autofix, helping teams move from discovery to remediation.

What the Assessment Reveals

• Scans up to 20 of an organization’s most active repositories.
• Reports vulnerabilities by severity:
  • Critical
  • High
  • Medium
  • Low
• Breaks findings down by programming language.
• Identifies the specific security rules and vulnerability classes detected.
• Highlights the repositories with the greatest number of vulnerabilities.
• Shows which findings are eligible for Copilot Autofix.
• Uses CodeQL, GitHub’s static analysis engine.

The assessment is free for organization administrators and security managers using GitHub Enterprise Cloud or GitHub Team. Scanning does not consume the organization’s GitHub Actions minutes quota.

Combining Code and Secret Exposure

The Code Security Risk Assessment complements GitHub’s existing Secret Risk Assessment.

• Both assessments can be launched from one entry point.
• A tabbed interface separates secret exposure findings from code vulnerabilities.
• The combined view helps organizations understand their overall security posture.
• Secret Protection focuses on preventing credential leaks.
• Code Security identifies and helps remediate vulnerabilities in source code.

GitHub cites 2025 usage figures for Secret Protection, including nearly 2 billion scanned pushes and 19 million blocked secret exposures.

From Detection to Remediation

Finding vulnerabilities is only the first step; reducing risk requires fixing them.

• GitHub reports that Copilot Autofix resolved 460,258 security alerts in 2025.
• Half of vulnerability alerts were fixed directly in pull requests.
• Mean remediation time was 0.66 hours with Copilot Autofix, compared with 1.29 hours for manual fixes.
• Assessment results show how many discovered vulnerabilities could potentially be fixed automatically.
• Organizations can enable GitHub Code Security directly from the results page.

The assessment is intended for organizations with no current scanning, teams evaluating existing tools, or security leaders seeking broader visibility across repositories. Running it provides a quick, no-cost baseline for prioritizing security work.