🗺️ Find the right Code Security guidance

[ghostinhershell]

Have a question about CodeQL, Dependabot, security advisories, Software Bill of Materials (SBOMs), or another Code Security feature? You may be able to find what you need in GitHub Docs or the GitHub Well-Architected Framework.

This post will help you choose the right resource and, if you still need help, share enough information for others to support you.

Which resource should I use?

• GitHub Docs explains how features work and provides setup and troubleshooting instructions.

• The GitHub Well-Architected Framework offers guidance for organizations making decisions about security, governance, rollout, and risk.

A good rule of thumb: start with Docs for a specific task or error. Use the Well-Architected Framework when you need to make a broader decision about how your organization should approach security.

Find guidance for your question

If you need help with...	Start with GitHub Docs	Explore the Well-Architected Framework
CodeQL build or analysis failures	Troubleshoot an automatic build failure, Configure CodeQL for compiled languages, Understand why fewer lines were scanned	Enforce GitHub Advanced Security at scale
The dependency graph or automatic dependency submission	Enable the dependency graph, Configure automatic dependency submission, Use the dependency submission API	Defend against dependency supply-chain attacks
Dependabot or maintaining secure dependencies	Review best practices for maintaining dependencies	Defend against dependency supply-chain attacks
SBOMs, artifact attestations, or build provenance	Export a software bill of materials, Use artifact attestations	Implement the NIST Secure Software Development Framework with GitHub
Prioritizing security alerts	Explore GitHub security features	Prioritize security-alert remediation
Repository security advisories or CVEs	Learn about repository security advisories, Manage privately reported vulnerabilities, Publish a repository security advisory	Implement the NIST Secure Software Development Framework with GitHub
A compromised organization or repository	Respond to a security incident, Review common investigation areas	Review the GitHub repositories threat model
Preventing unauthorized account access	Prevent unauthorized access	Review the GitHub repositories threat model
Security governance across an enterprise	Establish a governance framework	Review GitHub Enterprise policies and best practices, Enforce GitHub Advanced Security at scale
Reviewing AI-generated code securely	Review AI-generated code	Govern agents in GitHub Enterprise
Scanning AI-agent changes for secrets	Scan for secrets with the GitHub MCP server	Govern agents in GitHub Enterprise

Still need help? Start a discussion

If these resources don't answer your question, search the existing discussions before creating a new one. Someone may have already reported the same behavior or shared a solution.

When you start a discussion, please include:

- **Feature:** Which feature are you using?
- **Expected behavior:** What did you expect to happen?
- **Actual behavior:** What happened instead?
- **Error:** What was the exact error message?
- **Troubleshooting:** Which documentation or steps have you already tried?
- **Environment:** Include relevant languages, package ecosystems, runner types, and versions.
- **Reproduction:** If it is safe to do so, share a minimal example or public repository.

You don't need to be a security expert to ask a good question. Share what you know, explain where you got stuck, and remove anything private or sensitive.

These details help the Community understand whether you're dealing with a configuration question, documentation gap, possible product defect, or feature request.

Choose the right place for your question

Ask the Community when

The Community is a good place to ask when:

• Your question can be discussed publicly.

• You need help understanding or configuring a feature.

• You want to compare approaches or share a workaround.

• You have product feedback that others may also experience.

Contact GitHub Support when

Please use GitHub Support when:

• Your account or organization may be compromised.

• You're locked out, suspended, or unable to access private resources.

• Your question involves billing, licensing, or private account information.

• You need an update about a specific Support ticket.

• GitHub staff need to inspect private account or organization data.

The Community can't access private account details or provide updates about Support cases.

Report vulnerabilities privately

Please don't publish an unpatched vulnerability, exploit, credential, token, or other sensitive information in a Community discussion.

If a repository supports private vulnerability reporting, follow the instructions for privately reporting a security vulnerability.

Protect your information

Before posting, remove:

• Access tokens, API keys, passwords, and other secrets

• Private source code

• Personal or customer information

• Internal repository, organization, or network details

• Private messages from GitHub Support

If you accidentally expose a credential, revoke or rotate it immediately. Editing or deleting the post isn't enough because someone may have already copied it.

---

If these resources don't address a recurring question, please tell us. Your feedback can help identify where Docs need clarification, where new Community guidance may be useful, or where a problem should be shared with the appropriate GitHub team.