GitHub offers many code security products and features including GitHub Advanced Security, a suite of features designed to protect your organization from vulnerabilities in your code, insecure dependencies, leaked secrets, and more. For more information on GitHub Advanced Security, see "
About GitHub Advanced Security
."
You can easily enable and manage GitHub's security features throughout your organization with security configurations, which control repository-level security features, and global settings, which control security features at the organization level. We recommend applying security configurations
and
customizing your global settings to create a system that best meets the security needs of your organization.
Security configurations are collections of enablement settings for GitHub's security features that you can apply to any repository within your organization. There are two types of security configuration:
- The GitHub-recommended security configuration
. This configuration is a collection of enablement settings created and managed by subject matter experts at GitHub. The GitHub-recommended security configuration is designed to adequately secure any repository, and can easily be applied to all repositories in your organization.
- Custom security configurations
. These are configurations you can create and edit yourself, allowing you to choose different enablement settings for groups of repositories with specific security needs.
Note
If a user in your organization attempts to change the enablement status of a feature in an enforced configuration using the REST API, the API call will appear to succeed, but no enablement statuses will change.
Some situations can break the enforcement of security configurations for a repository. For example, the enablement of code scanning will not apply to a repository if:
- GitHub Actions is initially enabled on the repository, but is then disabled in the repository.
- GitHub Actions required by code scanning configurations are not available in the repository.
- The definition for which languages should not be analyzed using code scanning default setup is changed.
Each repository can only have one security configuration applied to it. To find out how you should get started with security configurations, see "
Choosing a security configuration for your repositories
."
While security configurations determine repository-level security settings, global settings determine your organization-level security settings, which are then inherited by all repositories. With global settings, you can customize how security features analyze your organization, as well as create security managers with permission to manage security alerts and settings across your organization.
To determine which security configurations are right for the repositories in your organization, see "
Choosing a security configuration for your repositories
."
