> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GHAS Overview The Layered Defense

> Explains GitHub Advanced Security as layered defenses using Dependabot, secret scanning, push protection, and CodeQL, and outlines billing and operational considerations

Security is the highest-weighted domain on the exam, accounting for 25–30% of your scope.

![A slide titled "Security on the Exam" stating that security makes up 25–30% of your exam score. A green progress bar highlights "Security" as the highest-weighted domain versus "Every other domain."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/GHAS-Overview-The-Layered-Defense/security-top-domain-25-30-percent.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=a565b504044fdbbbadf60ebbbd6478d1)

This lesson treats GitHub Advanced Security (GHAS) as a layered defense model rather than a disconnected feature set. Each layer addresses a specific class of risk; combined, they provide broad coverage across your development lifecycle.

Layered-defense analogy (think infection control in a hospital):

* Dependabot alerts = supplier auditing: scans incoming third-party packages for known vulnerabilities.
* Dependabot security updates = pharmacist: automatically creates PRs to replace vulnerable packages with safe versions.
* Secret scanning = security camera: detects dropped credentials or secrets in your codebase.
* Push protection = self-locking door: prevents pushes that would expose detected secrets.
* CodeQL = infection-control specialist: inspects your application logic for vulnerabilities in the code you wrote.

Example: a representative dependencies list Dependabot might scan

```text theme={null}
express 4.17.1
axios 0.21.1
lodash 4.17.15
```

![A presentation slide titled "Layer 2 – Dependabot Security Updates" that likens Dependabot to "the pharmacist." It shows a flow where a vulnerable axios 0.21.1 triggers a pull request and is updated to axios 1.6.8.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/GHAS-Overview-The-Layered-Defense/dependabot-pharmacist-security-axios-update.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=b5b48021ecc6dd9dbbf802b03c8edd96)

![A presentation slide titled "Layer 3 – Secret Scanning" that equates secret scanning to a security camera. The illustration shows a red key near a doorway being watched by a surveillance camera.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/GHAS-Overview-The-Layered-Defense/secret-scanning-camera-red-key.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=5dd6b9b23cbab0200bb7ab0ff6267dcc)

![A slide titled "Layer 4 – Push Protection" showing a green locked door (with a padlock icon), a red key on the floor and a camera, and a label equating "Push protection" to "The door that locks itself."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/GHAS-Overview-The-Layered-Defense/push-protection-self-locking-door.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=eb80410780a60789007f7426f6d73339)

CodeQL analyzes your own source code — the application logic your team writes — to detect issues such as insecure control flow, improper input validation, and unsafe API usage. Dependabot and CodeQL therefore protect different attack surfaces:

* Dependabot: third-party dependencies (code you consume).
* CodeQL: your application logic (code you produce).

Running only one tool leaves a blind spot: Dependabot-only misses vulnerabilities introduced in your own code; CodeQL-only misses known-issue third-party packages. Use both for comprehensive coverage.

Quick reference — Layer, focus, and example

| Layer | Tool(s) | Focus / What it protects | Example |
| - | - | - | - |
| Supply chain | Dependabot alerts & security updates | Known vulnerabilities in third-party packages | `axios 0.21.1` → update to `axios 1.6.8` |
| Secret protection | Secret scanning + Push protection | Accidental or malicious exposure of credentials | Detects an API key in a commit and blocks the push |
| Code analysis | CodeQL | Vulnerabilities in your source code logic | SQL injection, unsafe deserialization, input validation bugs |

Billing and operational considerations
You should also be familiar with GHAS billing because it affects cost management and enablement decisions.

Key billing rules:

* GHAS is free for public repositories.
* Billing counts unique human committers who committed to GHAS-enabled private repositories during the trailing 90-day window.
* Commits to public repositories do not contribute to billing.
* Archiving a GHAS-enabled private repository removes its committers from your billing count after 90 days.

![A slide titled "Archiving Drops Committers" showing an archived box icon labeled "Archived" and "Billing count: 0." Below it is a green 90-day window progress bar and a green pill button reading "A measurable cost lever."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/GHAS-Overview-The-Layered-Defense/archiving-drops-committers-archived-90day-progress.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=18a6eef68dc2fd5fdc99d8e8d7326e09)

Billing rules summarized

| Topic | Rule |
| - | - |
| Public repos | GHAS features are free for public repositories |
| Active committer | Any unique human who committed to a private GHAS-enabled repo in the trailing 90 days |
| Archived repos | Committers are removed from billing after the repository is archived and 90 days elapse |

Keep these billing facts in mind:

* GHAS is free for public repositories.
* An active committer is someone who committed to a private GHAS-enabled repository within the last 90 days.
* Archiving a GHAS-enabled private repository removes its committers from your billing count after 90 days.

Links and references

* GitHub Advanced Security overview: [https://docs.github.com/en/code-security](https://docs.github.com/en/code-security)
* Dependabot: [https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically)
* Secret scanning and push protection: [https://docs.github.com/en/code-security/secret-scanning](https://docs.github.com/en/code-security/secret-scanning)
* CodeQL: [https://codeql.github.com/docs/](https://codeql.github.com/docs/)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/87860708-f952-4381-9127-8a36eecad5d2)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.