GitHub Widens the Door on Advanced Security Trials

GitHub is expanding access to its advanced security tooling, GitHub Advanced Security (GHAS). Traditionally, organizations could only trial GHAS if they had up to 100 licenses. Now, any GitHub Enterprise Cloud organization with up to 300 licenses can start a 30-day trial directly from their billing and licensing page, without requiring a sales call or contract.

During this trial, organizations can add any number of committers and enable both GitHub Secret Protection and GitHub Code Security across all their organizations. If no purchase is made by the end of the trial, it automatically expires. This new eligibility threshold brings larger engineering organizations into the trial pool, who typically deal with more complex secret sprawl and dependency risks.

The trial covers Code Security, which uses CodeQL scanning to identify vulnerable patterns and risky dependencies, and Secret Protection, which scans for exposed credentials and API keys. These tools aim to block pull requests with exposed secrets instead of just reporting them after the fact. This move comes as GitHub continues to streamline the process for potential customers to evaluate GHAS, making it easier for teams to assess its effectiveness beyond a superficial scan-find-fix loop.

However, it's important to note that each organization can only participate in one trial, and they must plan for the trial window by testing on relevant repositories before day 30.