GitHub Advanced Security vs Snyk
Published prices, scan coverage, languages and AI autofix for GitHub Code Security, GitHub Secret Protection and Snyk, checked against vendor pages on October 25, 2026.
Short answer (checked October 25, 2026): if your repositories are on GitHub and you mostly need code scanning, secret scanning and dependency alerts, buy GitHub's own add-ons. GitHub Code Security is $30 and Secret Protection is $19 per active committer per month, Copilot Autofix comes with Code Security, and organizations on the GitHub Team plan can buy both without moving to Enterprise. Pick Snyk if your code is spread across GitLab, Bitbucket or Azure Repos as well as GitHub, if you write PHP or Scala (CodeQL supports neither), or if you want container image and IaC scanning from the same vendor, because GitHub's security plans list no scanner for either.
This page compares the two on published prices, plan limits and vendor documentation. Nothing here comes from running either tool against a test codebase. For Semgrep as a third option, see the three-way AI code security comparison.
Which one fits your team
| Your situation | Better fit | Why |
|---|---|---|
| All code on GitHub, mainstream languages | GitHub | CodeQL, Copilot Autofix, secret scanning and Dependabot run inside the repo with nothing extra to connect. |
| Repos on GitLab or Bitbucket | Snyk | GitHub's scanners run on GitHub and, through a separate Microsoft product, on Azure Repos. Snyk integrates with GitHub, GitLab, Bitbucket and Azure Repos. |
| PHP, Scala, Apex or COBOL in the stack | Snyk | GitHub's CodeQL docs name PHP and Scala as unsupported. Snyk Code lists all four. |
| Need container image or Terraform/Kubernetes scanning | Snyk | Snyk Container and Snyk IaC are part of every Snyk plan. GitHub can display third-party results but has no scanner of its own for either. |
| Fewer than 10 developers, tight budget | Snyk Free or Team | Snyk Free includes 100 Snyk Code tests a month, and Team is listed from $25 a month for up to 10 developers. |
| Public open-source repositories | GitHub | CodeQL, Copilot Autofix and secret scanning are free on public repositories. |
Prices and plans
Both vendors count people who committed in the last 90 days. GitHub bills per active committer, meaning anyone who pushed to a repository with Secret Protection or Code Security turned on, counted once per organization. Snyk's plans page counts contributing developers who committed to a private repo that Snyk monitors, and it ignores contributions to public repos.
| Plan | Price (list, Oct 25, 2026) | What you get |
|---|---|---|
| GitHub Free (public repos) | $0 | CodeQL, Copilot Autofix, secret scanning and push protection on public repositories. Dependency graph, Dependabot security updates and version updates on all repositories. |
| GitHub Secret Protection | $19 per active committer/month | Secret scanning and push protection on private repos, plus validity checks, Copilot secret scanning, generic patterns and bypass controls. |
| GitHub Code Security | $30 per active committer/month | CodeQL and Copilot Autofix on private repos, security campaigns, the dependency review action and third-party alert upload. |
| Snyk Free | $0 | 5 projects. Monthly test limits: 100 Snyk Code, 200 Open Source, 300 IaC and 100 Container tests. |
| Snyk Team | Starting at $25/month | Up to 10 developers and 100 projects, 1,000 Snyk Code tests a month, higher limits for the other products, Jira integration. |
| Snyk Enterprise | Quote (prepaid credits, 1 credit = $1) | Published credit rates per active contributor per day: Code 1.0, Open Source 1.0, Secrets 0.66, IaC 0.33. Container is 0.33 per monitored image per day. |
GitHub's prices come from github.com/security/plans. The two products replaced the single GitHub Advanced Security license on April 1, 2025, when GitHub also opened them to Team plan organizations. Snyk's page says Team starts at $25 a month but doesn't spell out how the price grows from one developer to ten, so confirm the per-seat figure at checkout.
What each one scans
| Area | GitHub | Snyk |
|---|---|---|
| Code (SAST) | CodeQL | Snyk Code, with interfile analysis in every supported language except COBOL |
| AI fixes | Copilot Autofix, for a subset of CodeQL queries | Snyk Agent Fix (previously DeepCode AI Fix), for every Snyk Code language |
| Open-source dependencies (SCA) | Dependency graph and Dependabot alerts and updates, using the GitHub Advisory Database | Snyk Open Source |
| Secrets | Secret Protection: scanning, push protection, validity checks | Snyk Secrets (listed only in the Enterprise credit rates) |
| Container images | No GitHub scanner; third-party results can be uploaded as SARIF | Snyk Container |
| Infrastructure as code | No GitHub scanner; third-party results via SARIF | Snyk IaC: Terraform (single file), CloudFormation, ARM (CLI only), Kubernetes manifests, Helm charts (SCM only) |
| Where it runs | GitHub; Azure Repos through GitHub Advanced Security for Azure DevOps | GitHub, GitLab, Bitbucket and Azure Repos integrations, plus CLI and IDE plugins |
Languages
CodeQL supports C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows. GitHub's docs name PHP and Scala as examples of languages it doesn't support.
Snyk Code supports Apex, C/C++, COBOL, Dart and Flutter, Go, Groovy, Java and Kotlin, JavaScript, .NET (C# and VB.NET), PHP, Python, Ruby, Rust, Scala, Swift and Objective-C, and TypeScript. Several of these come with conditions: Snyk's docs list Rust, Groovy, Dart and Objective-C code analysis as Early Access on Enterprise plans.
The overlap is wide for Java, JavaScript/TypeScript, Python, Go, C#, Ruby, Swift and C/C++. The differences sit at the edges: PHP, Scala, Apex and COBOL push you toward Snyk, while CodeQL lists Rust without an Early Access label and scans GitHub Actions workflows, which Snyk Code's language list doesn't include.
AI autofix: Copilot Autofix vs Snyk Agent Fix
Copilot Autofix drafts a fix for a CodeQL alert, and a developer reviews it in the pull request. GitHub's responsible-use page says it covers "a subset of queries" in C#, C/C++, Go, Java/Kotlin, Swift, JavaScript/TypeScript, Python, Ruby and Rust. The same page warns that alerts which need data-flow tracing across a complex multi-file codebase are hard for the model, that a suggestion may only partly fix the issue or land in the wrong place, and that every suggestion needs explicit developer review.
Snyk Agent Fix is the new name for DeepCode AI Fix. Snyk's docs say it moved to an agentic design in May 2026: the model drafts candidate fixes using Snyk's database of more than 35,000 human-written fixes, Snyk Code rescans each candidate, and a fix that fails the rescan goes back for another attempt. Snyk says it covers every language Snyk Code supports. You generate fixes from the IDE plugin. The documented limits are that it handles single-file fixes only, and that a fix usually takes under 8 seconds (median) but can take up to 2 minutes on large files.
The practical difference is where the fix appears. Copilot Autofix works in the pull request on GitHub. Snyk Agent Fix works in the editor before the code is pushed. Both vendors tell you to review the patch before merging it.
Where each one is weaker
GitHub
- The scanners work only on GitHub and, through a separately billed Microsoft product, on Azure Repos. GitLab and Bitbucket repositories are out.
- No first-party container image or IaC scanner. Code Security lets you upload SARIF results from other tools, so you still need another vendor to produce them.
- CodeQL has no PHP or Scala support.
- Copilot Autofix covers a subset of queries and, by GitHub's own account, can struggle with multi-file data flow.
- Dependabot alerts fire only for advisories that GitHub has reviewed in its Advisory Database. On private repos, the dependency review action needs Code Security.
Snyk
- The Team plan stops at 10 developers. Anything larger goes to an Enterprise quote, so the published prices stop helping once a team grows past that size.
- Free and Team plans are metered by test count per product (100 Snyk Code tests a month on Free, 1,000 on Team).
- Snyk Secrets and the Evo AI security products appear only in the Enterprise credit rates.
- Agent Fix fixes one file at a time, and Rust, Groovy, Dart and Objective-C code analysis are Early Access on Enterprise.
- Snyk IaC scans Terraform one file at a time, ARM templates only through the CLI, and Helm charts only through SCM integrations.
Running both
The two can run side by side. A common split is GitHub for CodeQL, secret push protection and Dependabot, with Snyk for containers and IaC. GitHub code scanning accepts SARIF uploads from other tools, so findings from a second scanner can show up in the repository's Security tab, which requires Code Security on private repositories. Before paying for both, check whether the overlap in SAST and dependency scanning is large enough that you would end up triaging the same finding twice.
Sources
All checked October 25, 2026: GitHub security plans, GitHub changelog, April 1, 2025, GitHub active committer billing, CodeQL languages, Copilot Autofix responsible use, dependency review, Dependabot alerts, Snyk plans, Snyk supported languages, Snyk Agent Fix, Snyk IaC languages, Snyk SCM integrations.