Skip to content
NewsProduct launch

GitHub adds repository protection status to its security risk assessments

· by

The short version

GitHub's code security and secret risk assessments now flag whether each finding sits in a protected or unprotected repository, giving admins a way to prioritize which repos need coverage first.

GitHub adds repository protection status to its security risk assessments

GitHub's risk assessments used to tell admins how many vulnerabilities or exposed secrets existed across an organization, but not which of those findings sat in a repository nobody had bothered to lock down. As of November 2, 2026, that gap closes: code security and secret risk assessments now flag whether each finding is in a protected or unprotected repository, per GitHub's changelog.

What shipped

The update applies to both the code security risk assessment and the secret risk assessment, GitHub said in the changelog. Previously, an assessment surfaced a count and severity breakdown of findings; now it also marks whether the affected repository has protection in place, which GitHub frames as a way to "identify where to extend your security coverage." Organization admins and security managers can start an assessment from the Assessments tab under their organization's Security settings. The protection-status view is live now for code security risk assessments in GitHub Enterprise Cloud and GitHub Team. For the secret risk assessment, the same capability is also rolling out to GitHub Enterprise Server, arriving in version 3.24, GitHub said.

Unprotected repos with open findings move to the top of the list

Before this release, an admin running an org-wide risk assessment got a flat list: so many vulnerabilities here, so many exposed secrets there, sorted by severity or repo name. Deciding which repository to fix first meant cross-referencing that list against a separate view of branch rules and access settings, repo by repo. Splitting findings by protection status collapses that into one view: a security manager can now see directly which flagged repositories have no protection at all, rather than inferring it. That matters most at organizations running dozens or hundreds of repos through GitHub Advanced Security, where the unprotected-and-vulnerable intersection is the highest-risk bucket and the one most likely to get missed in a severity-only sort.

The change also reflects a narrower reality: having Advanced Security turned on for a repo does not mean that repo is actually protected. A repository can run code scanning and secret scanning and still allow direct pushes to its default branch with no required reviews. Surfacing protection status next to each finding makes that distinction visible inside the same assessment, instead of requiring a second pass through repository settings.

What to watch next

Watch whether GitHub extends protection-status breakdowns to other Advanced Security surfaces, such as the organization-wide security overview and coverage dashboards, rather than keeping it scoped to the two risk assessments. The GitHub Enterprise Server 3.24 release, which brings the secret risk assessment version of this feature to self-hosted customers, is the next concrete milestone to track.

Sources