Managing security and analysis settings for your organization

About management of security and analysis settings

GitHub can help secure the repositories in your organization. You can manage the security and analysis features for all existing or new repositories that members create in your organization.

Displaying the security and analysis settings

1. In the top right corner of GitHub Enterprise Server, click your profile photo, then click Your organizations.

2. Next to the organization, click Settings.

3. In the left sidebar, click Security & analysis.

The page that's displayed allows you to enable or disable all security and analysis features for the repositories in your organization.

If you have a license for GitHub Advanced Security, the page will also contain options to enable and disable Advanced Security features. Any repositories that use GitHub Advanced Security are listed at the bottom of the page.

Enabling or disabling a feature for all existing repositories

You can enable or disable features for all repositories.

1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

2. Under "Code security and analysis", to the right of the feature, click Disable all or Enable all. The control for "GitHub Advanced Security" is disabled if you have no available seats for GitHub Advanced Security.

   

3. Click Enable/Disable all or Enable/Disable for eligible repositories to confirm the change.

When you enable one or more security and analysis features for existing repositories, you will see any results displayed on GitHub within minutes:

• All the existing repositories will have the selected configuration.
• New repositories will follow the selected configuration if you've enabled the checkbox for new repositories.
• If enabled, Dependabot security updates will create pull requests to upgrade vulnerable dependencies when Dependabot alerts are triggered.

Enabling or disabling a feature automatically when new repositories are added

1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

2. Under "Code security and analysis", to the right of the feature, enable or disable the feature by default for new repositories in your organization.

   

Allowing Dependabot to access private dependencies

Dependabot can check for outdated dependency references in a project and automatically generate a pull request to update them. To do this, Dependabot must have access to all of the targeted dependency files. Typically, version updates will fail if one or more dependencies are inaccessible. For more information, see "About Dependabot version updates."

By default, Dependabot can't update dependencies that are located in private repositories or private package registries. However, if a dependency is in a private GitHub repository within the same organization as the project that uses that dependency, you can allow Dependabot to update the version successfully by giving it access to the host repository.

If your code depends on packages in a private registry, you can allow Dependabot to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the dependabot.yml file for the repository. For more information, see "Configuration options for the dependabot.yml file."

To allow Dependabot to access a private GitHub repository:

1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

2. Under "Dependabot private repository access", click Add private repositories or Add internal and private repositories.

3. Start typing the name of the repository you want to allow.

4. Click the repository you want to allow.

5. Optionally, to remove a repository from the list, to the right of the repository, click .

Removing access to GitHub Advanced Security from individual repositories in an organization

You can manage access to GitHub Advanced Security features for a repository from its "Settings" tab. For more information, see "Managing security and analysis settings for your repository." However, you can also disable GitHub Advanced Security features for a repository from the "Settings" tab for the organization.

1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."
2. To see a list of all the repositories in your organization with GitHub Advanced Security enabled, scroll to the "GitHub Advanced Security repositories" section. The table lists the number of unique committers for each repository. This is the number of seats you could free up by removing access to GitHub Advanced Security. For more information, see "About billing for GitHub Advanced Security."
3. To remove access to GitHub Advanced Security from a repository and free up seats used by any active committers that are unique to the repository, click the adjacent .
4. In the confirmation dialog, click Remove repository to remove access to the features of GitHub Advanced Security.

Further reading

• "Securing your repository"
• "About secret scanning"
• "About the dependency graph"
• "About supply chain security"