Domain 1: GitHub Security Suites, Features, and Ecosystem
- GitHub now packages its security capabilities as two standalone products: GitHub Secret Protection (secret scanning and push protection) and GitHub Code Security (code scanning with CodeQL and related supply chain tooling). These succeeded the single bundled GitHub Advanced Security offering, and the underlying feature names are unchanged.
- Feature availability depends on repository visibility: many security features are free on public repositories, while secret scanning, push protection, and code scanning require a license on private and internal repositories, and Dependabot alerts remain free everywhere.
- The broader GitHub security ecosystem includes the secret scanning partner program, the GitHub Advisory Database, and support for ingesting third-party analysis results through SARIF, so external tools can surface alerts alongside the native ones.
- GitHub recognizes a SECURITY policy file automatically only when it lives in the repository root, a docs folder, or a .github folder, and links it from the Security tab.
- By default only repository administrators and security managers can view secret scanning alerts; broader visibility must be granted deliberately to other users or teams.
- The security manager role grants read access across all of an organization's repositories plus write access to security alerts, without full owner-level administrative control.
- Dependabot alerts are a free core feature that works on private repositories without any GHAS license, unlike secret scanning and its push protection.
- Secret scanning push protection blocks a push containing a recognized secret pattern before it enters repository history, and an authorized user can request a bypass with a stated reason.
- Custom secret scanning patterns let an organization define its own detection rule, usually a regular expression, for token formats not covered by GitHub's built-in patterns.
- GHAS on GitHub Enterprise Server requires a license applied to the instance, either synced through GitHub Connect or uploaded directly.
- Private vulnerability reporting is enabled in a repository's Code security and analysis settings, after which researchers use the Report a vulnerability button on the Security tab.
- GitHub acts as a CVE Numbering Authority (CNA) and can issue a CVE identifier directly from within the security advisory workflow.
- A malware advisory flags an intentionally malicious package and carries no CVSS score because removal, not patching, is the recommended remediation.
- The security overview dashboard gives an organization a consolidated view of alert data across all of its repositories.
- Partner validity checks let secret scanning confirm with the issuing provider whether a detected secret is still active, and publishing a security advisory deletes the temporary private fork used to build the fix.
Domain 2: Secret Protection
- The secret scanning alert list can be filtered by secret type, validity status, and alert state (open or closed).
- Validity checks classify supported secrets as active, inactive, or unknown based on the partner provider's response to GitHub's query.
- Secret scanning covers GitHub Discussions posts and comments, issues, pull requests, and wikis, not just source code.
- Push protection must be opted into per custom pattern; when a push is blocked, an authorized user can bypass it with a permitted reason if the organization allows it.
- A secret buried in an earlier commit must be removed from that specific commit, typically via interactive rebase, since amending only the tip leaves it in history.
- Repository-level custom patterns are capped at a fixed maximum, and reaching that limit prevents adding another pattern at that level.
- Deleting a custom pattern stops new alerts but leaves already-recorded alerts visible in the Security tab.
- A dedicated locations REST endpoint returns where a secret match was found, including the commit and file path.
- Secret scanning alert access can be scoped independently through a dedicated read permission without granting broader repository or code access.
- Structured tokens with a well-defined format are treated as high-confidence, while broad heuristics like generic password detection are classified as generic and rely on surrounding context.
- Organizations can enable push protection immediately across all existing repositories rather than only new ones, and Security overview includes a secret scanning metrics page summarizing push protection activity.
- An inactive secret should be formally resolved with a resolution reason (such as false positive, revoked, or used in tests) so remediation metrics stay accurate.
Domain 3: Supply Chain Security
- Direct dependencies are explicitly declared in a manifest, while transitive dependencies are pulled in indirectly and are revealed through a lockfile's resolved tree.
- NuGet projects need a packages.lock.json file for the dependency graph to show transitive packages, and Python projects need a lockfile like Pipfile.lock or poetry.lock beyond requirements.txt.
- In dependabot.yml, the allow key restricts Dependabot to only the listed dependencies, while setting open-pull-requests-limit to 0 for an ecosystem stops all new version-update PRs without deleting the entry.
- The groups key bundles matching version updates (such as devDependencies) into a single combined pull request, and the plural directories key matches multiple paths or globs in one entry.
- Security update pull requests require the dependency graph, Dependabot alerts, and Dependabot security updates to all be enabled together.
- Dependency review runs as a pull request check that flags vulnerable dependencies introduced by that change; fail-on-severity sets the threshold and allow-ghsas excludes specific advisory IDs.
- Pausing Dependabot from the repository's Dependabot page suspends new pull requests while preserving the existing configuration.
- Calling the Dependabot alerts REST endpoints requires a GitHub App to hold the dedicated Dependabot alerts permission, and Dependabot secrets are stored separately from Actions secrets.
- A Dependabot alert centers on the affected version range, the patched version, and the CVSS-derived severity rating.
- GitHub exposes a REST endpoint under the dependency graph that returns the repository's SBOM in SPDX format.
- Auto-triage rules can match alerts (for example low-severity, development-scoped findings) and auto-dismiss them automatically.
- Self-hosted runners processing Dependabot update jobs need the dependabot label and a working Docker installation.
Domain 4: Code Security
- Default setup enables CodeQL with minimal configuration, while advanced setup uses a workflow file and suits custom build handling or combining CodeQL with an external SARIF-producing tool.
- A CodeQL workflow separates configuration of languages and queries in an init step from the scan performed in a later analyze step.
- build-mode is set per language: none for interpreted languages, and autobuild or manual for compiled languages such as C#, C++, or Java that require an actual build.
- In the queries field, prefixing a suite name with a plus sign adds it to the default suite instead of replacing it, and a relative path can point to a local directory of custom .ql files.
- Severity is the query's own error, warning, or note classification, whereas security-severity is a separate CVSS-style numeric score used to rank real-world risk.
- The category value in a SARIF upload attributes alerts to a specific tool or analysis configuration, keeping multiple uploads from overwriting each other.
- Alert fingerprints combine the rule with the code's location and context, so a finding at a different file and line is treated as a new alert rather than a reopened dismissal.
- Copilot Autofix suggestions include a natural-language explanation plus a proposed code change the developer can commit to the pull request branch.
- Rendering a full source-to-sink flow path in the results UI requires the path-problem query kind, which is built on path-flow classes; the plain problem kind surfaces a single location only.
- A source is where tainted data enters, a sink is where it causes harm if it arrives unsanitized, and a barrier marks a point where tainted data should no longer be considered to flow.
- A Configuration class exposing isSource and isSink predicates is the standard pattern for expressing global data flow or taint tracking.
- codeql database analyze accepts sarif-latest, which code scanning uploads accept, while CSV output suits internal reporting but is not accepted for upload.
- The @id metadata is the stable machine identifier code scanning uses to recognize the same query's alerts across scans, and @name supplies the human-readable alert title.
- Compiled languages like Java, C++, and Go rely on tracing an actual build for extraction, so a CodeQL database only captures code compiled during that traced build.
- Interpreted languages are extracted by parsing source text, so even unreachable code ends up in the database.
- Customize a standard query by copying it into your own pack and extending its logic, leaving the installed library untouched so upgrades do not overwrite it.
Domain 5: Security Operations and Remediation
- Code scanning alerts are triaged by setting a state and, when dismissed, choosing a reason such as false positive, used in tests, or won't fix, and the recorded reason lets reviewers understand why an alert was closed.
- The security overview supports ongoing operations by tracking alert trends, enablement coverage, and remediation activity across the organization, helping teams monitor mean time to remediate and spot repositories that lag on triage.
- Remediation follows a consistent workflow: confirm the finding, apply a fix or an accepted dismissal with justification, then verify closure with a fresh scan rather than assuming a merge resolved it.
- GitHub Actions has no built-in on trigger for code scanning, secret scanning, or Dependabot alert events, so reacting to them requires an external receiver that forwards the webhook and calls the repository dispatch API.
- Every webhook configuration page keeps a Recent Deliveries log showing each attempt, its response status, and a redeliver option to replay events missed during a receiver outage.
- An organization-level security configuration that applies secure defaults ensures every new repository inherits protection automatically without manual per-repository setup.
- A ruleset that requires the code scanning results status check to pass can target many repositories at once, enforcing a consistent merge gate without per-repository branch protection.
- Real confirmation that a fix worked comes from a fresh scan no longer reporting the finding and the specific alert transitioning to closed, not from a merged status alone.
- A reopened alert with a new data flow path deserves fresh review because the code that produced the earlier dismissal has since changed.
- Fix-level remediations are parameterized queries for SQL injection, context-appropriate output encoding for cross-site scripting, and path normalization for path traversal.
- Rolling out a blocking check first in advisory (non-blocking) mode with advance notice of the enforcement date lets teams prepare while an untriaged backlog is cleared.
- The resolution field records why a secret scanning alert was closed, and every documented dismissal preserves context so later reviewers can judge whether the decision still holds.
- Enabling or disabling a feature such as push protection generates an audit log entry recording the setting change and the actor who made it.
- Organization-level alert endpoints cover many repositories in far fewer calls, simplifying pagination and rate-limit budgeting compared to per-repository calls.
- A GitHub App installation's rate limit scales with the installation size, such as its repository and user counts, up to a documented ceiling.
Domain 6: GitHub Security Suites Administration
- The security-events write permission is what authorizes a workflow token to upload SARIF analysis results into code scanning.
- GitHub Connect must first be enabled at the enterprise level, after which individual features such as advisory database sync and Actions sync are turned on separately.
- Dependabot alerts rely on the synced advisory database, so on a GHES instance without that Connect feature the instance will not know about recently disclosed vulnerabilities.
- An air-gapped GHES instance that blocks outbound internet access loses GitHub Connect, so administrators must manually download and upload the CodeQL Action and CLI bundle and advisory data on a recurring basis.
- GHAS billing counts active committers, defined by qualifying pushes within a rolling 90-day window, so removing a departed engineer's access does not immediately clear their committer count.
- An external collaborator who pushes to a GHAS-enabled repository is counted as an active committer just like an organization member.
- Metered billing has no predefined committer cap, so unlike a fixed-volume license it does not block enabling Advanced Security on additional repositories.
- Turning on automatic enablement of Advanced Security for new repositories has no retroactive effect on repositories that already existed.
- The organization-level security configuration includes a bulk action that enables default setup across all eligible repositories, still bounded by available committer licenses.
- Enabling secret scanning across many existing repositories triggers an initial historical scan of their content, creating a temporary burst of load, so expanding the self-hosted runner pool beforehand avoids overwhelming capacity.
- The enterprise-level secret scanning alerts endpoint returns open alerts across all organizations in the enterprise, and the security overview supports a visibility filter such as private.
- Feature availability can be version-gated, so a capability present on github.com may not yet have shipped in every supported GHES release.
GitHub Advanced Security exam tips
- Memorize what each GHAS feature requires: Dependabot alerts are free, but secret scanning, push protection, and CodeQL code scanning need a GHAS license on private repositories.
- Know the exact dependabot.yml keys and their effects (allow, ignore, groups, directories, open-pull-requests-limit, schedule) since the exam tests configuration outcomes directly.
- For CodeQL questions, keep build-mode straight: none for interpreted languages, autobuild or manual for compiled ones, and remember path-problem is required for source-to-sink flow paths.
- When a question asks how to confirm a fix, choose the answer involving a fresh scan and the alert transitioning to closed, not a merge or a manual dismissal.
- Watch for the 90-day active-committer billing window and the fact that automatic enablement settings are never retroactive to existing repositories.
Study guide FAQ
How many questions are on the GH-500 exam and what is the passing score?
The GitHub Advanced Security exam draws from a large pool and is delivered in 100 minutes with a scaled passing score of 700. It covers all of GitHub's security features from secret scanning through enterprise administration.
Do I need a GHAS license to use Dependabot?
No. Dependabot alerts are a free core feature that works on private repositories without a GHAS license. A GHAS license is required for secret scanning, push protection, and CodeQL code scanning on private and internal repositories.
What is the difference between default setup and advanced setup for code scanning?
Default setup enables CodeQL with minimal configuration and automatic language detection, while advanced setup uses an editable workflow file. Choose advanced setup when you need custom build commands or want to combine CodeQL with an external SARIF-producing tool.
How does GHAS billing count usage?
GHAS bills by active committers, a unique user counted if they pushed to a GHAS-enabled repository within the last 90 days. External collaborators count too, and removing a user's access does not immediately clear their count until the 90-day window elapses.