CodeQL is GitHub's semantic code-analysis engine that queries code as data to find security vulnerabilities. It powers Code Security, supports customizable query suites and language-specific analysis, and produces alerts with dataflow insight.
GitHub Advanced Security (GHAS) is the suite of features that secures code, secrets, and dependencies across the software-development lifecycle.
Secret Protection is the current name for the feature formerly called secret scanning, which detects credentials and tokens committed to a repository.
Push Protection is a Secret Protection capability that blocks commits containing detected secrets before they reach the remote repository.
Code Security is the current name for code scanning with CodeQL, the feature that analyzes source code for vulnerabilities and errors.
CodeQL is GitHub's semantic code-analysis engine that queries code as data to find security vulnerabilities.
Supply chain security is the current umbrella for the features formerly delivered as Dependabot and Dependency Review, protecting a project's dependencies.
Dependabot is the automation that raises alerts and opens pull requests to update vulnerable or outdated dependencies.
The dependency graph is a representation of the packages and versions a repository depends on, including transitive dependencies.
An SBOM (Software Bill of Materials) is a formal, exportable inventory of the components and dependencies in a piece of software.
Dependency Review is a pre-merge check that shows the security and license impact of dependency changes in a pull request before they are merged.
EPSS (Exploit Prediction Scoring System) is a model that estimates the probability that a vulnerability will be exploited in the wild.
SARIF (Static Analysis Results Interchange Format) is the standard JSON format GitHub uses to ingest and display code-scanning results.
A security campaign is a coordinated, tracked effort to remediate a defined set of security alerts across repositories.
The Security Overview is a consolidated dashboard that shows the security posture and alert status across an organization's repositories.
Delegated bypass is a policy that lets designated reviewers approve or deny requests to bypass a security control such as Push Protection.