Build a custom security configuration to meet the specific security needs of repositories in your organization.
Organization owners, security managers, and organization members with the admin role
We recommend securing your organization with the GitHub-recommended security configuration, then evaluating the security findings on your repositories before configuring custom security configurations. For more information, see Applying the GitHub-recommended security configuration in your organization.
With custom security configurations, you can create collections of enablement settings for GitHub's security products to meet the specific security needs of your organization. For example, you can create a different custom security configuration for each group of repositories to reflect their different levels of visibility, risk tolerance, and impact.
You can also choose whether or not you want to include GitHub Code Security or GitHub Secret Protection features in a configuration. If you do, keep in mind that these features incur usage costs (or require GitHub Advanced Security licenses) when applied to private and internal repositories. For more information, see About GitHub Advanced Security.
Important
The order and names of some settings will differ depending on whether you are using licenses for the original GitHub Advanced Security product, or for the two new products: GitHub Code Security and GitHub Secret Protection. See Creating a GitHub Advanced Security configuration or Creating a Secret Protection and Code Security configuration.
In the upper-right corner of GitHub, click your profile picture, then click Organizations.
Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.
In the "Security" section of the sidebar, select the Advanced Security dropdown menu, then click Configurations.
In the "Security configurations" section, click New configuration.
To help identify your custom security configuration and clarify its purpose on the "Security configurations" page, name your configuration and create a description.
Optionally, enable "Secret Protection", a paid feature for private repositories. Enabling Secret Protection enables alerts for secret scanning. In addition, you can choose whether to enable, disable, or keep the existing settings for the following secret scanning features:
Optionally, enable "Code Security", a paid feature for private repositories. You can choose whether to enable, disable, or keep the existing settings for the following code scanning features:
Note
To create a configuration that you can apply to all repositories regardless of current code scanning setup, choose "Enabled with advanced setup allowed". This setting enables default setup only in repositories where CodeQL analysis is not actively run. Option available from GitHub Enterprise Server 3.19.
Still under "Code Security", in the "Dependency scanning" table, choose whether you want to enable, disable, or keep the existing settings for the following dependency scanning features:
Tip
When both "Code Security" and Dependency graph are enabled, this enables dependency review, see About dependency review.
For "Private vulnerability reporting", choose whether you want to enable, disable, or keep the existing settings. To learn about private vulnerability reporting, see Configuring private vulnerability reporting for a repository.
Optionally, in the "Policy" section, you can use additional options to control how the configuration is applied:
The default security configuration for an organization is only automatically applied to new repositories created in your organization. If a repository is transferred into your organization, you will still need to apply an appropriate security configuration to the repository manually.
To finish creating your custom security configuration, click Save configuration.
If a user in your enterprise attempts to change the enablement status of a feature in an enforced configuration using the REST API, the API call will appear to succeed, but no enablement statuses will change.
Some situations can break the enforcement of security configurations for a repository. For example, the enablement of code scanning will not apply to a repository if:
To help identify your custom security configuration and clarify its purpose on the "New configuration" page, name your configuration and create a description.
In the "GitHub Advanced Security features" row, choose whether to include or exclude GitHub Advanced Security (GHAS) features.
In the "Secret scanning" table, choose whether you want to enable, disable, or keep the existing settings for the following security features:
In the "Code scanning" table, choose whether you want to enable, disable, or keep the existing settings for code scanning default setup.
In the "Dependency scanning" table, choose whether you want to enable, disable, or keep the existing settings for the following dependency scanning features:
When both "GitHub Advanced Security" and Dependency graph are enabled, this enables dependency review, see About dependency review.
To apply your custom security configuration to repositories in your organization, see Applying a custom security configuration.
To learn how to edit your custom security configuration, see