Security risk assessments include repository protection status

GitHub's code security and secret risk assessments now show whether findings are in protected or unprotected repositories. That tells you where to extend security coverage.

Organization admins and security managers can start an assessment from Assessments under the organization's Security tab. The code security risk assessment is a free scan of up to 20 private and internal repositories. It reports the vulnerabilities it finds, their severity, and how many Copilot Autofix can fix. The secret risk assessment runs separately, in its own tab.

The protection status is available in GitHub Enterprise Cloud and GitHub Team. For the secret risk assessment, it will come to GitHub Enterprise Server 3.24.