GitHub Advanced Security bills two SKUs per active committer: Code Security at $30/committer/month, Secret Protection at $19/committer/month — both counting anyone who pushed a commit in the trailing 90 days, not your headcount. A 10-committer team on both runs about $490/month. GeekWala's Pro plan is a flat $12/month regardless of team size.
GitHub's pricing page for Advanced Security shows two clean per-committer numbers, but "active committer" is doing a lot of work in that sentence — it's not your headcount, not your GitHub seat count, and not a number you set. It's whoever actually pushed a commit to a covered repository within the trailing 90 days, which means your bill can move up or down between months without anyone changing a subscription setting.
Want the full side-by-side breakdown? See our GitHub Advanced Security pricing comparison for the SKU-by-SKU table against GeekWala's flat rate. This article instead walks through why "active committer" billing moves your total between months.
What GitHub Advanced Security Costs, by SKU
| SKU | Price | What it includes |
|---|---|---|
| Code Security | $30/active committer/month | CodeQL semantic code analysis, Copilot Autofix (auto-generates fixes for ~90% of alert types in JS/TS/Java/Python), dependency graph, Dependabot security + version updates, dependency review, custom auto-triage rules |
| Secret Protection | $19/active committer/month | Secret scanning across git history/PRs/issues/wikis, push protection, provider pattern detection (AWS/Azure/GCP), validity checks on active secrets, AI-powered detection for unstructured passwords |
| Free tier (public repos) | $0 | Basic secret scanning (Secret Protection); CodeQL, dependency graph, and Dependabot updates (Code Security) — public repositories only |
Source: github.com/security/plans, verified 2026-09-15 ($30/$19 per active committer/month unchanged since the 2026-09-08 access). GitHub may revise SKU pricing and scope — verify current figures directly on GitHub's site before budgeting.
Two things worth knowing before the numbers below:
- The two SKUs are billed independently. A team that only wants secret scanning pays $19/committer/month; a team that only wants code scanning pays $30/committer/month. Most teams evaluating "GitHub Advanced Security" as a bundle are actually pricing both together.
- "Active committer" is a rolling 90-day window, not a calendar billing period. Unlike a fixed per-seat license, a contractor who pushes one commit during a busy sprint stays on the bill for 90 days from that commit, even if they never touch the repository again.
What a Real Team Actually Pays
Applying the published per-committer rates to common team sizes shows how fast the bill compounds: a 5-committer team, a 10-committer team, and a 20-committer team, each priced for Code Security alone and for Code Security plus Secret Protection together, at GitHub's published monthly rates below.
| Active committers | Code Security only | Code Security + Secret Protection | Notes |
|---|---|---|---|
| 5 | $150/mo | $245/mo | Smallest teams still pay the full per-committer rate — no minimum-seat floor, but no volume discount either |
| 10 | $300/mo | $490/mo | Linear scaling — double the committers, double the bill |
| 20 | $600/mo | $980/mo | Before any GitHub Enterprise-tier licensing costs, which Advanced Security is layered on top of |
Same source as above: github.com/security/plans, verified 2026-09-15.
The pattern is the same shape as most per-seat AppSec pricing: cost scales linearly with how many people commit code, not with how much security review actually happens. A team where 3 people triage every Dependabot alert and CodeQL finding still pays for all 20 active committers, because the metric is "who pushed code," not "who uses the security tooling."
Where This Fits Against Dependabot (Which Most Teams Already Have)
GitHub Code Security is best understood as the paid upgrade path from the free Dependabot alerts most GitHub teams already have — it adds CodeQL semantic scanning, Copilot Autofix, dependency review, and custom auto-triage rules for the same Dependabot alerts, none of which cost anything on their own.
See GeekWala vs Dependabot for how the free tier compares and what it already covers, and GeekWala vs GitHub Code Security for the full feature comparison against the paid SKU specifically.
The Alternative: A Flat Rate Regardless of Team Size
GeekWala's Pro plan is $12/month flat — one price whether your team has 5 active committers or 50, because GeekWala bills per account, not per active committer. The Free tier covers 50 scans/month across 5 projects and 200 packages, with EPSS exploit-probability scoring and CISA KEV active-exploitation status on every finding — a signal GitHub's auto-triage-rules approach doesn't expose the same way.
This isn't a claim that GeekWala replaces GitHub Advanced Security feature-for-feature — it doesn't. GeekWala has no CodeQL-equivalent semantic code scanning, no Copilot Autofix, and no secret scanning; it's a focused dependency (SCA) scanner. If code scanning and secret scanning bundled into your existing GitHub billing are genuine requirements, Code Security and Secret Protection's per-committer price reflects real, GitHub-native capability GeekWala doesn't offer. The comparison here is specifically for teams whose primary need is dependency vulnerability scanning with exploitation-aware prioritization.
| GitHub Code Security (10 active committers) | GeekWala (any team size, Pro) | |
|---|---|---|
| Monthly cost | ~$300/mo | $12/mo |
| Pricing model | Per active committer | Flat, per account |
| CISA KEV exposed as a field | No | Yes — flagged on every finding, ranked first |
| EPSS exposed as a field | No | Yes — shown on every finding |
| CodeQL / semantic code scanning | Yes | No (SCA only) |
| Requires GitHub | Yes | No — works from any lockfile |
For the complete feature-and-pricing matrix beyond cost alone, see GeekWala vs GitHub Code Security.
Frequently Asked Questions
Does GitHub offer a flat team rate instead of per-active-committer pricing?
Not at either published SKU. Code Security and Secret Protection both bill per active committer with no published minimum or team-wide flat option. GitHub doesn't publish whether custom flat-rate arrangements exist for large enterprise agreements — that requires a sales conversation.
What exactly counts as an "active committer" for billing?
Per GitHub's billing documentation, an active committer is anyone who has pushed a commit to a repository with Advanced Security enabled within the trailing 90 days — a rolling window, not a fixed monthly headcount. A committer drops off the count only once 90 days pass with no new commit.
Is Code Security's free tier enough for a small team?
Only for public repositories — CodeQL, dependency graph, and Dependabot updates are free there. Private repositories require the paid Code Security SKU for CodeQL and Copilot Autofix; free Dependabot alerts (without CodeQL or Copilot Autofix) remain available on private repos independent of Advanced Security.
Does GeekWala's $12/month Pro plan include code scanning or secret scanning?
No. GeekWala is a dependency (SCA) scanner only — npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems, and NuGet. If CodeQL-style semantic code scanning or secret scanning are requirements, GitHub Advanced Security is the correct comparison, not GeekWala. See Free Dependency Scanning Tools in 2026 for the broader landscape of tools by scope and cost.
How current are the GitHub figures in this article?
Pulled directly from github.com/security/plans on 2026-09-08. Vendor pricing pages change without notice — verify current figures directly with GitHub before budgeting.
GitHub Advanced Security's per-committer pricing scales with your commit history. GeekWala's flat rate doesn't.
