Skip to main content

Managing security and analysis settings for your organization

You can control features that secure and analyze the code in your organization's projects on GitHub.

Who can use this feature

Organization owners can manage security and analysis settings for repositories in the organization.

About management of security and analysis settings

GitHub can help secure the repositories in your organization. You can manage the security and analysis features for all existing or new repositories that members create in your organization. Organizations that use GitHub Enterprise Cloud with a license for GitHub Advanced Security can also manage access to these features. For more information, see the GitHub Enterprise Cloud documentation.

注意:你不能禁用公共存储库默认启用的某些安全和分析功能。

如果启用了安全和分析功能,GitHub 将对存储库执行只读分析。 有关详细信息,请参阅“[关于 GitHub 对数据的使用](/github/understanding-how-github-uses-and-protects-your-data/about-githubs-use-of-your-data)”。

Displaying the security and analysis settings

  1. 在 GitHub.com 的右上角,单击你的个人资料照片,然后单击“你的组织”。 贵组织在配置文件菜单中

  2. 在组织旁边,单击“设置”。 设置按钮

  3. In the "Security" section of the sidebar, click Code security and analysis.

The page that's displayed allows you to enable or disable all security and analysis features for the repositories in your organization.

Enabling or disabling a feature for all existing repositories

You can enable or disable features for all repositories. The impact of your changes on repositories in your organization is determined by their visibility:

  • Dependency graph - Your changes affect only private repositories because the feature is always enabled for public repositories.
  • Dependabot alerts - Your changes affect all repositories.
  • Dependabot security updates - Your changes affect all repositories.
  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Code security and analysis", to the right of the feature, click Disable all or Enable all.

    "Enable all" or "Disable all" button for "Configure security and analysis" features

  3. Optionally, enable the feature by default for new repositories in your organization.

    "Enable by default" option for new repositories

  4. Click Disable FEATURE or Enable FEATURE to disable or enable the feature for all the repositories in your organization.

    Button to disable or enable feature

当您为现有仓库启用一个或多个安全和分析功能时,您将在几分钟内看到 GitHub 上显示的任何结果:

  • 所有现有仓库将具有选定的配置。
  • 如果启用了新存储库的复选框,则新存储库将遵循所选配置。
  • 我们使用权限扫描清单文件以应用相关服务。
  • 如果启用,您将在依赖关系图中看到依赖项信息。
  • 如果启用,GitHub 将对易受攻击的依赖项或恶意软件生成 Dependabot alerts。
  • 如果启用,Dependabot 安全更新将在触发 Dependabot alerts 时创建拉取请求以升级易受攻击的依赖项。

Enabling or disabling a feature automatically when new repositories are added

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Code security and analysis", to the right of the feature, enable or disable the feature by default for new repositories, or all new private repositories, in your organization.

    Screenshot of a checkbox for enabling a feature for new repositories

Allowing Dependabot to access private dependencies

Dependabot can check for outdated dependency references in a project and automatically generate a pull request to update them. To do this, Dependabot must have access to all of the targeted dependency files. Typically, version updates will fail if one or more dependencies are inaccessible. For more information, see "About Dependabot version updates."

By default, Dependabot can't update dependencies that are located in private repositories or private package registries. However, if a dependency is in a private GitHub repository within the same organization as the project that uses that dependency, you can allow Dependabot to update the version successfully by giving it access to the host repository.

If your code depends on packages in a private registry, you can allow Dependabot to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the dependabot.yml file for the repository. For more information, see "Configuration options for the dependabot.yml file."

To allow Dependabot to access a private GitHub repository:

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Dependabot private repository access", click Add private repositories or Add internal and private repositories. Add repositories button

  3. Start typing the name of the repository you want to allow. Repository search field with filtered dropdown

  4. Click the repository you want to allow.

  5. Optionally, to remove a repository from the list, to the right of the repository, click . "X" button to remove a repository

Further reading