Code Security risk assessment available for organizations 🚀

[ebndev]

Organization admins and security managers can now run a free Code Security risk assessment to review security vulnerabilities across their organization.

The assessment summarizes vulnerabilities by severity, rule type, and programming language. It includes remediation guidance, highlighting where Copilot Autofix can automatically suggest fixes. The report enables you to identify high-impact repositories to prioritize, and helps understand how to remediate security issues faster. To initiate an assessment, navigate to the "Assessments" section under your organization’s Security tab.

This feature is available in GitHub Enterprise Cloud and GitHub Team, and will ship in GitHub Enterprise Server 3.22.

Read more in the Code Security risk assessment documentation.

🌟Leave a comment!

Join the discussion and leave feedback in the comments below!

[matshch]

Code security scanning failed for us on all 20 repositories. Perhaps organizations with enabled IP allow list are not supported?

[dorothymitchell]

You are correct  1�7 when an organization has an IP allow list enabled, Code Security risk assessment fails because GitHub-hosted runners are blocked. This is a limitation of the Code Security risk assessment because it uses Actions to run Code Security. We're updating the user experience to make this clear.

In the meantime, to run the Code Security risk assessment, you would need to temporarily update your organization's IP allow list settings to permit GitHub-hosted runners. Thank you for raising this feedback!

[snarfed]

Exciting! Any chance of expanding this to user repositories any time soon? I'd love to use this, but my big open source repos are mostly on my user, not in an org.

[dorothymitchell]

Code Security, Secret Protection and Dependabot are already free for all public repositories, including those owned by user accounts. Whilst the Code Security risk assessment isn't available, you can go ahead and enable Code Security on your open source user repos today to get access to your full results.

Right now, we don’t have plans to bring Code Security to private user-owned repositories, but we’re always reviewing feedback and our roadmap. If anything changes, we’ll be sure to keep you updated!