Skip to main content

This version of GitHub Enterprise was discontinued on 2022-06-03. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

Managing security and analysis settings for your repository

You can control features that secure and analyze the code in your project on GitHub.

People with admin permissions to a repository can manage security and analysis settings for the repository.

Enabling or disabling security and analysis features

You can manage the security and analysis features for your repository. If your organization belongs to an enterprise with a license for GitHub Advanced Security then extra options are available. For more information, see "About GitHub Advanced Security."

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. Repository settings button

  3. In the left sidebar, click Security & analysis. "Security & analysis" tab in repository settings

  4. Under "Code security and analysis", to the right of the feature, click Disable or Enable. The control for "GitHub Advanced Security" is disabled if your enterprise has no available licenses for Advanced Security. Screenshot of "Enable" or "Disable" button for "Configure security and analysis" features

    Note: If you disable GitHub Advanced Security, secret scanning and code scanning are disabled. Any workflows, SARIF uploads, or API calls for code scanning will fail.

Granting access to security alerts

Security alerts for a repository are visible to people with admin access to the repository and, when the repository is owned by an organization, organization owners. You can give additional teams and people access to the alerts.

Organization owners and repository administrators can only grant access to view security alerts, such as secret scanning alerts, to people or teams who have write access to the repo.

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. Repository settings button

  3. In the left sidebar, click Security & analysis. "Security & analysis" tab in repository settings

  4. Under "Access to alerts", in the search field, start typing the name of the person or team you'd like to find, then click a name in the list of matches.

    Search field for granting people or teams access to security alerts

  5. Click Save changes.

    "Save changes" button for changes to security alert settings

Removing access to security alerts

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. Repository settings button

  3. In the left sidebar, click Security & analysis. "Security & analysis" tab in repository settings

  4. Under "Access to alerts", to the right of the person or team whose access you'd like to remove, click .

    "x" button to remove someone's access to security alerts for your repository

  5. Click Save changes.

Further reading