About securing your organization
GitHub offers many code security products and features including GitHub Advanced Security, a suite of features designed to protect your organization from vulnerabilities in your code, insecure dependencies, leaked secrets, and more. For more information on GitHub Advanced Security, see About GitHub Advanced Security.
You can easily enable and manage GitHub's security features throughout your organization with security configurations, which control repository-level security features, and global settings, which control security features at the organization level. We recommend applying security configurations and customizing your global settings to create a system that best meets the security needs of your organization.
About security configurations
Security configurations are collections of enablement settings for GitHub's security features that you can apply to any repository within your organization.
You can customize security configurations, allowing you to choose different enablement settings for groups of repositories with specific security needs.
You will only ever see enablement settings for features that have been installed on your GitHub Enterprise Server instance by an enterprise administrator.
Note
If a user in your organization attempts to change the enablement status of a feature in an enforced configuration using the REST API, the API call will appear to succeed, but no enablement statuses will change.
Some situations can break the enforcement of security configurations for a repository. For example, the enablement of code scanning will not apply to a repository if:
- GitHub Actions is initially enabled on the repository, but is then disabled in the repository.
- GitHub Actions required by code scanning configurations are not available in the repository.
- Self-hosted runners with the label
code-scanningare not available. - The definition for which languages should not be analyzed using code scanning default setup is changed.
Each repository can only have one security configuration applied to it.
About global settings
While security configurations determine repository-level security settings, global settings determine your organization-level security settings, which are then inherited by all repositories. With global settings, you can customize how security features analyze your organization, as well as grant a team permission to manage security alerts and settings across your organization.
Next steps
To get started with creating a security configuration for your organization, see Creating a custom security configuration.