GitHub Security Risk Assessments
GitHub risk assessments scan your repositories for exposed credentials and code vulnerabilities, giving your team the insight to understand current risk and prioritize what to address next.
How exposed is your organization? Run a free assessment to find out.
Secret risk assessment
Scan your repositories for leaked credentials and see where secrets appear, which types are most common, and where protection can reduce risk.
Code security risk assessment
Scan up to 20 active repositories to identify vulnerabilities, understand risk by severity, and see where Copilot Autofix may help speed remediation.
What you'll see in your results
A clear picture of your organization's exposure, so you can understand where risk stands today, align on priorities, and make better business decisions.
How it works
Run the assessment
An organization admin or security manager starts the scan. The secret risk assessment reviews every repository in your organization, while the code security risk assessment scans up to 20 repositories you choose. GitHub emails you when your results are ready.
Review the results
Open the Code Security and Secret Protection tabs to review the results from each assessment. Secret Protection results appear as repositories are processed, while Code Security results are available after the full scan is complete.
Take the next step
Eligible enterprise admins can start a GitHub Advanced Security trial directly from the risk assessment. If you're not eligible for a self-serve trial, you can enable Secret Protection or Code Security directly from the assessment or talk to an expert at GitHub.
Your repositories. Your findings. Your call.
Test your actual code
Decide with evidence, not assumptions
Validate what's working and find what isn't
Frequently asked questions
