Managing security and analysis settings for your organization

You can control features that secure and analyze the code in your organization's projects on GitHub.

Organization owners can manage security and analysis settings for repositories in the organization.

About management of security and analysis settings

GitHub can help secure the repositories in your organization. You can manage the security and analysis features for all existing or new repositories that members create in your organization. If you have a license for GitHub Advanced Security then you can also manage access to these features. Para obtener más información, consulta la sección "Acerca de GitHub Advanced Security".

Nota: No puedes inhabilitar algunas características de seguridad y análisis que están habilitadas predeterminadamente para los repositorios públicos.

Si habilitas las características de seguridad y de análisis, GitHub realizará análisis de solo lectura en tu repositorio. Para obtener más información, consulta la sección "Acerca de cómo GitHub utiliza tus datos".

Displaying the security and analysis settings

  1. En la esquina superior derecha de GitHub.com, haz clic en tu foto de perfil y luego en Tus organizaciones. Tus organizaciones en el menú de perfil
  2. Junto a la organización, haz clic en Configuración. El botón de configuración
  3. En la barra lateral izquierda, da clic en Seguridad & análisis. Pestaña de "Seguridad & análisis"

The page that's displayed allows you to enable or disable all security and analysis features for the repositories in your organization.

If your organization belongs to an enterprise with a license for GitHub Advanced Security, the page will also contain options to enable and disable Advanced Security features. Any repositories that use GitHub Advanced Security are listed at the bottom of the page.

Enabling or disabling a feature for all existing repositories

You can enable or disable features for all repositories. The impact of your changes on repositories in your organization is determined by their visibility:

  • Dependency graph - Your changes affect only private repositories because the feature is always enabled for public repositories.
  • Las alertas del dependabot - Your changes affect all repositories.
  • Actualizaciones de seguridad del dependabot - Your changes affect all repositories.
  • GitHub Advanced Security - Your changes affect only private repositories because GitHub Advanced Security and the related features are always enabled for public repositories.
  • Escaneo de secretos - Your changes affect only private repositories where GitHub Advanced Security is also enabled. Escaneo de secretos is always enabled for public repositories.
**Nota:** Si habilitas

GitHub Advanced Security, los confirmantes de estos repositorios utilizarán las plazas en tu licencia de GitHub Advanced Security. Esta opción se inhabilita si excediste la capacidad de tu licencia. Para obtener más información, consulta la sección "Acerca de la facturación para la GitHub Advanced Security".

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Configure security and analysis features", to the right of the feature, click Disable all or Enable all. The control for "GitHub Advanced Security" is disabled if you have no available seats in your GitHub Advanced Security license.

    "Enable all" or "Disable all" button for "Configure security and analysis" features

  3. Optionally, enable the feature by default for new repositories in your organization.

    "Enable by default" option for new repositories

  4. Click Disable FEATURE or Enable FEATURE to disable or enable the feature for all the repositories in your organization.

    Button to disable or enable feature

Cuando habilitas una o más características de seguridad y análisis para los repositorios existentes, verás cualquier resultado que se muestra en GitHub al cabo de unos pocos minutos:

  • Todos los repositorios existentes tendrán la configuración seleccionada.
  • Los repositorios nuevos seguirán la configuración seleccionada si habilitaste la casilla de verificación para estos.
  • Utilizamos los permisos para escanear en busca de archivos de manifiesto para aplicar los servicios relevantes.
  • Si se habilita, verás la información de dependencias en la gráfica de dependencias.
  • Si se habilita, GitHub generará Las alertas del dependabot para las dependencias vulnerables.
  • Si se habilita, las actualizaciones de seguridad del Dependabot crearán solicitudes de cambios para actualizar las dependencias vulnerables cuando se activen las Las alertas del dependabot.

Enabling or disabling a feature automatically when new repositories are added

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Configure security and analysis features", to the right of the feature, enable or disable the feature by default for new repositories, or all new private repositories, in your organization.

    Checkbox for enabling or disabling a feature for new repositories

Allowing Dependabot to access private dependencies

Dependabot can check for outdated dependency references in a project and automatically generate a pull request to update them. To do this, Dependabot must have access to all of the targeted dependency files. Typically, version updates will fail if one or more dependencies are inaccessible. For more information, see "About Dependabot version updates."

By default, Dependabot can't update dependencies that are located in private repositories or private package registries. However, if a dependency is in a private GitHub repository within the same organization as the project that uses that dependency, you can allow Dependabot to update the version successfully by giving it access to the host repository.

If your code depends on packages in a private registry, you can allow Dependabot to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the dependabot.yml file for the repository. For more information, see "Configuration options for dependency updates."

To allow Dependabot to access a private GitHub repository:

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Dependabot private repository access", click Add private repositories or Add internal and private repositories. Add repositories button

  3. Start typing the name of the repository you want to allow. Repository search field with filtered dropdown

  4. Click the repository you want to allow.

  5. Optionally, to remove a repository from the list, to the right of the repository, click . "X" button to remove a repository

Removing access to GitHub Advanced Security from individual repositories in an organization

You can manage access to GitHub Advanced Security features for a repository from its "Settings" tab. For more information, see "Managing security and analysis settings for your repository." However, you can also disable GitHub Advanced Security features for a repository from the "Settings" tab for the organization.

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."
  2. To see a list of all the repositories in your organization with GitHub Advanced Security enabled, scroll to the "GitHub Advanced Security repositories" section. GitHub Advanced Security repositories section The table lists the number of unique committers for each repository. This is the number of seats you could free up on your license by removing access to GitHub Advanced Security. For more information, see "About billing for GitHub Advanced Security."
  3. To remove access to GitHub Advanced Security from a repository and free up seats used by any committers that are unique to the repository, click the adjacent .
  4. In the confirmation dialog, click Remove repository to remove access to the features of GitHub Advanced Security.

Note: If you remove access to GitHub Advanced Security for a repository, you should communicate with the affected development team so that they know that the change was intended. This ensures that they don't waste time debugging failed runs of code scanning.

Further reading

¿Te ayudó este documento?

Política de privacidad

¡Ayúdanos a hacer geniales estos documentos!

Todos los documentos de GitHub son de código abierto. ¿Notas algo que esté mal o que no sea claro? Emite una solicitud de cambios.

Haz una contribución

O, aprende cómo contribuir.