Skip to main content
Security is the highest-weighted domain on the exam, accounting for 25–30% of your scope.
A slide titled "Security on the Exam" stating that security makes up 25–30% of your exam score. A green progress bar highlights "Security" as the highest-weighted domain versus "Every other domain."
This lesson treats GitHub Advanced Security (GHAS) as a layered defense model rather than a disconnected feature set. Each layer addresses a specific class of risk; combined, they provide broad coverage across your development lifecycle. Layered-defense analogy (think infection control in a hospital):
  • Dependabot alerts = supplier auditing: scans incoming third-party packages for known vulnerabilities.
  • Dependabot security updates = pharmacist: automatically creates PRs to replace vulnerable packages with safe versions.
  • Secret scanning = security camera: detects dropped credentials or secrets in your codebase.
  • Push protection = self-locking door: prevents pushes that would expose detected secrets.
  • CodeQL = infection-control specialist: inspects your application logic for vulnerabilities in the code you wrote.
Example: a representative dependencies list Dependabot might scan
A presentation slide titled "Layer 2 – Dependabot Security Updates" that likens Dependabot to "the pharmacist." It shows a flow where a vulnerable axios 0.21.1 triggers a pull request and is updated to axios 1.6.8.
A presentation slide titled "Layer 3 – Secret Scanning" that equates secret scanning to a security camera. The illustration shows a red key near a doorway being watched by a surveillance camera.
A slide titled "Layer 4 – Push Protection" showing a green locked door (with a padlock icon), a red key on the floor and a camera, and a label equating "Push protection" to "The door that locks itself."
CodeQL analyzes your own source code — the application logic your team writes — to detect issues such as insecure control flow, improper input validation, and unsafe API usage. Dependabot and CodeQL therefore protect different attack surfaces:
  • Dependabot: third-party dependencies (code you consume).
  • CodeQL: your application logic (code you produce).
Running only one tool leaves a blind spot: Dependabot-only misses vulnerabilities introduced in your own code; CodeQL-only misses known-issue third-party packages. Use both for comprehensive coverage. Quick reference — Layer, focus, and example Billing and operational considerations You should also be familiar with GHAS billing because it affects cost management and enablement decisions. Key billing rules:
  • GHAS is free for public repositories.
  • Billing counts unique human committers who committed to GHAS-enabled private repositories during the trailing 90-day window.
  • Commits to public repositories do not contribute to billing.
  • Archiving a GHAS-enabled private repository removes its committers from your billing count after 90 days.
A slide titled "Archiving Drops Committers" showing an archived box icon labeled "Archived" and "Billing count: 0." Below it is a green 90-day window progress bar and a green pill button reading "A measurable cost lever."
Billing rules summarized
Keep these billing facts in mind:
  • GHAS is free for public repositories.
  • An active committer is someone who committed to a private GHAS-enabled repository within the last 90 days.
  • Archiving a GHAS-enabled private repository removes its committers from your billing count after 90 days.
Links and references

Watch Video