GH-500 cheat sheet

Exam at a glance

Domain weightings

How much of the exam each domain covers. Spend your study time in proportion — the heavier the domain, the more questions you'll see.

Key terms

GitHub Advanced Security

GitHub Advanced Security (GHAS) is the suite of features that secures code, secrets, and dependencies across the software-development lifecycle. As of the July 2026 packaging it is offered as the standalone GitHub Secret Protection and GitHub Code Security products alongside supply chain security.

Secret Protection

Secret Protection is the current name for the feature formerly called secret scanning, which detects credentials and tokens committed to a repository. It includes Push Protection, validity checks, prioritized alerting, and custom secret patterns.

Push Protection

Push Protection is a Secret Protection capability that blocks commits containing detected secrets before they reach the remote repository. It prevents secret exposure at the source rather than alerting after the fact; by default a user with write access can bypass a block by providing a reason, unless a delegated bypass policy restricts who may bypass.

Code Security

Code Security is the current name for code scanning with CodeQL, the feature that analyzes source code for vulnerabilities and errors. It ingests SARIF results, supports native and third-party analysis, and offers autofix and severity management.

CodeQL

CodeQL is GitHub's semantic code-analysis engine that queries code as data to find security vulnerabilities. It powers Code Security, supports customizable query suites and language-specific analysis, and produces alerts with dataflow insight.

Supply chain security

Supply chain security is the current umbrella for the features formerly delivered as Dependabot and Dependency Review, protecting a project's dependencies. It covers the dependency graph, SBOM export, vulnerability alerts, and pre-merge Dependency Review.

Dependabot

Dependabot is the automation that raises alerts and opens pull requests to update vulnerable or outdated dependencies. It supports grouping, auto-dismiss behavior, and configurable update strategies within supply chain security.

Dependency graph

The dependency graph is a representation of the packages and versions a repository depends on, including transitive dependencies. It underpins vulnerability alerts and SBOM generation and gives supply-chain context for remediation.

SBOM

An SBOM (Software Bill of Materials) is a formal, exportable inventory of the components and dependencies in a piece of software. GitHub can generate an SBOM from the dependency graph in standard formats for supply-chain transparency and compliance.

Dependency Review

Dependency Review is a pre-merge check that shows the security and license impact of dependency changes in a pull request before they are merged. It lets teams catch vulnerable or non-compliant packages during code review.

EPSS

EPSS (Exploit Prediction Scoring System) is a model that estimates the probability that a vulnerability will be exploited in the wild. GitHub uses EPSS to help prioritize supply-chain and security alerts beyond raw severity.

SARIF

SARIF (Static Analysis Results Interchange Format) is the standard JSON format GitHub uses to ingest and display code-scanning results. It lets CodeQL and third-party analysis tools report findings into Code Security interoperably.

Security campaign

A security campaign is a coordinated, tracked effort to remediate a defined set of security alerts across repositories. It supports bulk alert management and prioritization so security teams can drive down risk at scale.

Security Overview

The Security Overview is a consolidated dashboard that shows the security posture and alert status across an organization's repositories. It helps teams monitor coverage, prioritize risk, and track remediation progress.

Delegated bypass

Delegated bypass is a policy that lets designated reviewers approve or deny requests to bypass a security control such as Push Protection. It enforces role-based governance so bypasses are auditable rather than unrestricted.