Integration
Scan private GitHub repositories, without paying per committer.
GitHub scans public repositories for free. Private repositories need GitHub Code Security, sold per active committer on Team and Enterprise plans. p4ndora audits any private repository a read-only token can reach, at one price per repository.
Facts checked 21 October 2026. By p4ndora research, Security research at p4ndora.ai. 5 min read.
The short answer
How do I security scan a private GitHub repository?
Connect it to p4ndora with a fine-grained token that can only read, then start a scan. On Continuous every push is checked with unlimited scans for one price per repository, with no committer licenses and no Actions minutes.
- Unlimited scans. Every push checked on Continuous, for one price per repository. No quota and no meter.
- No committer licenses. Works on every GitHub plan, including Free and Pro. p4ndora counts nobody, only the repository.
- Read-only by design. The scan reads with one token. Pull requests use a second token, only after you confirm.
What one price includes
Unlimited scans. No usage limits. Any repository size.
Continuous, $499.50 a month per repository.
- Unlimited scans. Every push to your branch is checked against the last known state. No monthly quota.
- No usage limits. No test counts, no credits and no build minutes. The price stays the same however much you push.
- Any repository size. A side project and a large monorepo cost the same.
- Your whole team. No seats. Everyone who commits to the repository is covered.
- Automatic fixes. Fixes are drafted for you and opened as draft pull requests to review.
Or start with one scan for $149.50, paid once. New accounts get their first scan free.
How does p4ndora compare with GitHub Code Security?
| p4ndora | GitHub Code Security | |
|---|---|---|
| Scans | Unlimited on Continuous, every push checked | Code scanning runs in GitHub Actions and uses its minutes |
| Who is counted | Nobody, the price is per repository | Every active committer |
| Private repositories | Any repository a read-only token can reach | Needs a GitHub Code Security license |
| Who can buy it | Any GitHub account, including Free and Pro | GitHub Team and Enterprise plans |
| Price | $149.50 per scan, or $499.50 per month per repository | $30 per active committer a month |
| What it is | A security audit of your repository, one pinned commit at a time | CodeQL code scanning and Copilot Autofix, built into GitHub |
| Fixes | Drafted for you and opened as draft pull requests | Copilot Autofix for most alert types in JavaScript, TypeScript, Java and Python |
| Other code hosts | GitLab too, including self-managed | GitHub only |
Facts about GitHub Code Security come from its public website, checked on 21 October 2026. Plans and features change, so check github.com for the latest.
Which one should you choose?
Choose GitHub Code Security if
- You already pay for GitHub Team or Enterprise
- You have many repositories and few committers
Choose p4ndora if
- Your private repository is on Free or Pro
- You want unlimited scans for one price per repository
- You do not want to pay for every committer
- You want an audit with proof and fixes, without build setup
- You use GitLab too
Keep Dependabot either way. GitHub offers its dependency alerts on every plan, for public and private repositories. p4ndora checks your packages against published advisories too, in the same report as your code.
How do I connect a private GitHub repository?
- Create a fine-grained token. In GitHub, choose the repositories p4ndora may read and give the token read-only access to Contents and Metadata, with an expiry date.
- Connect it in p4ndora. Paste the token once. p4ndora lists the repositories it can read.
- Choose the branch and start. Pick the repository and branch. The scan reads one pinned commit and changes nothing.
- Allow pull requests if you want them. To open fixes as draft pull requests, add a second fine-grained token that may write. The read token never writes.
What does a p4ndora finding look like?
Each finding names its kind and CWE, carries a rating from critical to low with a CVSS estimate, and shows the exact lines with the route from where input enters your code to where it does harm. The ones that matter come with a small fix in the style of your code, ready to review.
Questions
- Is GitHub code scanning free for private repositories?
- No. GitHub says code scanning on private repositories needs a GitHub Code Security license, which is sold to GitHub Team and Enterprise plans. Public repositories get code scanning for free.
- Does p4ndora limit scans or repository size?
- No. Continuous includes unlimited scans of its repository, with every push checked, and the price is the same for a small project or a large monorepo. There are no quotas, credits or seats.
- Does p4ndora need a GitHub App?
- No. You connect with a fine-grained personal access token limited to the repositories you choose, with read-only access to Contents and Metadata.
- Can p4ndora open pull requests on GitHub?
- Yes. After you confirm a fix, p4ndora opens a draft pull request through a separate fine-grained token that may write. Classic tokens are not accepted for this.
- Does a p4ndora scan use my GitHub Actions minutes?
- No. The scan runs on p4ndora and reads the repository through the token. Nothing is added to your workflows.
- Can I scan a GitHub repository for free?
- Yes. New accounts can start with a free scan of one repository. Every finding is counted and rated, and the most serious one opens in full.
Audit your private repository today.
Connect one GitHub repository with a read-only token and get every finding counted and rated. The first scan is free for new accounts.