Comparison

vetkit and GitHub Advanced Security: what each covers

GitHub’s built-in security covers code scanning, secrets and dependencies. vetkit adds a repository audit for quality, AI-specific risks and production readiness.

November 1, 2026 · 7 min read · By the vetkit team

The short version

If your code is on GitHub, you already have access to some strong security features, and on public repositories several of them cost nothing. Secret scanning with push protection, Dependabot and CodeQL code scanning are worth turning on before you buy anything else, including vetkit.

vetkit is not a replacement for them. It is a repository audit that looks at a wider set of questions (code quality, dependency licenses and maintenance, production readiness and mistakes typical of AI-assisted code) and turns the answers into a graded report and a tracked backlog. Its findings can also be exported as SARIF, the format GitHub code scanning accepts from third-party tools.

What GitHub Advanced Security is

GitHub Advanced Security is GitHub’s set of security features, now offered as two products: GitHub Secret Protection and GitHub Code Security. Code scanning runs CodeQL or a third-party tool and shows alerts in pull requests and in the repository’s Security tab. Secret scanning finds credentials in your repository, and push protection can block them before they are pushed. Dependabot alerts on vulnerable dependencies and can open pull requests to update them. Copilot Autofix suggests fixes for code scanning alerts.

Several of these features are free on public repositories, and private repositories need a paid plan. The details change from time to time, so check GitHub’s security plans page for the current split. GitHub also offers a separate Code Quality product, and the GitHub MCP server includes tools for code security, secret protection and Dependabot alerts, so coding agents can work with these alerts directly.

These features are built for repositories hosted on GitHub. Azure Repos has its own GitHub Advanced Security for Azure DevOps offering.

What vetkit is

vetkit audits a repository and produces one graded report across five suites: security, code quality, sustainability, AI code risks and production readiness. It reads a temporary checkout and never installs, builds or runs your code. It builds on open-source engines such as gitleaks, OSV-Scanner, Opengrep with vetkit’s own rules, Trivy and tree-sitter, plus its own checks.

Some of what it checks is outside GitHub’s security features: packages that do not exist on public registries, unfinished implementations, Supabase tables without row level security, LLM features that trust model output, HTTP calls without timeouts, queries inside loops, test maturity, dependency licenses and maintenance activity. Findings can be assigned with target dates, and risk acceptance needs a reason and an administrator’s review in team organizations.

vetkit connects to coding agents through a local MCP server and a REST API. It is in early access, with a free Security Quick Scan; paid plans are not yet on sale.

Side by side

GitHub Advanced Security and vetkit side by side
Topic	GitHub Advanced Security	vetkit
Primary job	Security alerts built into GitHub repositories and pull requests	Repository audit across five suites, with a remediation workflow
Secrets	Secret scanning, plus push protection that can block pushes	Secret scanning of the audited commit; values are redacted before storage
Dependencies	Dependabot alerts and automated update pull requests	Known vulnerabilities, licenses, deprecated or stale packages, invented package names
Code analysis	CodeQL or third-party tools via SARIF upload	Opengrep with vetkit rules, plus quality, AI-risk and production readiness checks
Code quality	Offered as a separate GitHub Code Quality product	Included: complexity, duplication, test maturity, documentation, repository health
Agent integration	GitHub MCP server with security toolsets	Local MCP server and REST API
Source control	GitHub; a separate offering for Azure Repos	GitHub; GitLab.com and Bitbucket Cloud repositories can also be connected
Getting started	Several features free on public repositories; paid for private	Free Security Quick Scan; paid plans not yet available

When GitHub’s features are enough

Your main concerns are leaked credentials and vulnerable dependencies, and you want them handled where you already work.
You want secrets blocked at push time, before they ever reach the repository.
You want automatic dependency update pull requests.
Your repositories are public, so much of this is available at no cost.

When vetkit adds something

You want to know whether the codebase is ready for production, not only whether it has known vulnerabilities.
A lot of the code was written with AI assistants and you want checks for the mistakes that come with that.
You need one report you can share with people who do not live in GitHub’s Security tab, such as founders, clients or auditors.
Some of your repositories are on GitLab or Bitbucket.

Using both

Turn on secret scanning, push protection and Dependabot first. They prevent problems early and cost little. Then use vetkit for a periodic audit of the whole repository and the areas GitHub’s security features do not cover. If you want everything in one place, export vetkit’s findings as SARIF and upload them to GitHub code scanning.

Sources

We checked the information about other products on this page against their public documentation on November 1, 2026. Products change quickly, so treat the vendor’s own documentation as the final word.

GitHub, GitHub Advanced Security, CodeQL, Dependabot, Copilot are trademarks of their respective owners. vetkit is not affiliated with, endorsed by or sponsored by them. Names are used only to identify the products being compared. Spotted something out of date or wrong? Email contact@vetkit.dev and we will correct it.