---
title: "GitHub Universe 2026 security features: plans and costs"
description: "I checked the GitHub Universe 2026 security launches in the official changelog and docs: npm package firewall, Dependabot reachability, AI Scan, and more. Plans, costs, and limits."
url: https://udon-dev.com/en/notes/github-universe-2026-security/
lang: en
published: 2026-11-06
topic: [security, ai]
tags: ["github", "supply-chain", "dependabot", "code-scanning"]
---

# GitHub Universe 2026 security features: plans and costs

- Package firewall is a public preview for npm only, on GitHub Enterprise Cloud. It blocks versions published less than a day ago, known malware, versions with critical vulnerabilities, and more, before they install. It is free during the preview
- Dependabot reachability analysis labels JavaScript and TypeScript alerts as reachable, unreachable, and so on. The label never closes an alert, and pushing code does not trigger a recalculation. It runs every 24 hours
- AI Scan for pull requests also covers languages CodeQL does not support, but its findings are advisory and never block a merge
- Agentic autofix, AI Scan, and AI-powered push protection for secrets consume AI credits for Code Security and Secret Protection, and show up as "Advanced Security" under "AI usage" on the Enterprise billing page

GitHub Universe 2026 took place in San Francisco on October 28 and 29. The keynotes centered on the Copilot app and Copilot Fusion. But a [report from Cloud Watch](https://cloud.watch.impress.co.jp/docs/event/2153516.html) (Japanese), a Japanese IT news site, also includes an interview with Pierre Tempel, Director of Product Management for security. He named "taking security out of the corner and building it into the SDLC (software development lifecycle)" as a main emphasis this year.

The security announcements fall into two groups: features that restrict which dependencies get installed, and features that use AI to inspect code and alerts. The required plan, supported languages, and billing model differ from feature to feature. This post lists, feature by feature, the conditions you should know before you decide to adopt them. I covered Agentic Workflows, Projects in the Copilot app, and Copilot Dreaming in [a separate post on three features you can try today](/en/notes/github-universe-2026-try-today/).

## The announcements at a glance

Some of these were published in the changelog before Universe and then presented in interviews during the event. Dates are changelog publication dates.

| Feature | Stage | Requirements | Cost |
|---|---|---|---|
| Package firewall | Public preview (October 20) | GitHub Enterprise Cloud. npm only | Free during the preview. Usage-based billing after general availability |
| Dependabot reachability analysis | Public preview (October 28) | GitHub Enterprise Cloud. JavaScript and TypeScript | Free during the preview. No Code Security license required |
| AI Scan for pull requests | Generally available (October 15) | Public repositories. Private repositories need Code Security or Advanced Security | AI credits for Code Security |
| AI Scan for repositories | Public preview (October 28) | Same as above. Private repositories owned by personal accounts are not covered | AI credits for Code Security |
| Agentic autofix | Generally available (October 15) | GitHub Enterprise Cloud with Code Security or Advanced Security | AI credits and Actions minutes |
| AI-powered push protection for secrets | Public preview (October 28) | Secret Protection or Advanced Security | AI credits for Secret Protection. Off by default |

Two more features entered public preview. One is "code scanning for AI applications", which checks code that embeds AI agents for risks such as prompt injection. It requires an Advanced Security license. The other is an extension that lets you work with code scanning alerts in the Copilot app. Its `/security-review` command, which checks local changes, works on any Copilot plan. Viewing, fixing, or dismissing existing alerts requires code scanning to be enabled, and private repositories also need Code Security.

## What package firewall blocks, and its defaults

[Package firewall](https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview) is a proxy that sits between developer machines, CI runners, and coding agents on one side and the public npm registry on the other. GitHub cites the ongoing wave of malware that runs at install time, and notes that agents and CI, which install dependencies with no human watching, are especially attractive targets.

According to [the documentation](https://docs.github.com/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/protecting-endpoints-with-package-firewall), an enterprise owner or security manager sets the following items as an enterprise-wide policy.

（図: Image from the GitHub Changelog. The package firewall settings screen, with known malware blocking set to On and the severity threshold set to Critical only）
Source: [GitHub package firewall in public preview (GitHub Changelog)](https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview)

| Setting | What it blocks | Default |
|---|---|---|
| Known malware | Versions with a malware advisory in the GitHub Advisory Database | On |
| Vulnerability advisories | Versions with a vulnerability at or above the chosen severity | Critical only |
| Attestation regression | New versions missing an SLSA attestation that the previous version had | On |
| Newly added install scripts | Versions that recently gained a `preinstall` or `postinstall` script | On |
| Minimum age since publication | Versions published fewer than the specified number of days ago (0–365) | 1 day |

On the client side, you point the registry in npm's `.npmrc` at your enterprise's firewall URL and attach a token from an enterprise member. The token only needs read access to public repositories. The docs also describe placing the firewall upstream of JFrog Artifactory, but that setup is experimental. If Artifactory keeps a direct route to the public registry, packages can bypass the firewall, so the docs tell you to remove that route.

The setting to watch in day-to-day use is the minimum age. A version that just fixed a vulnerability is also blocked until it is old enough. When something is blocked, the npm output or CI log shows a URL for requesting an exception, and once an administrator approves it, the exception is added to the policy. For packages where a request every time would be wasted effort, such as ones your company publishes itself, you can create an exception that allows all versions.

GitHub's Adam Leftik told [Help Net Security](https://helpnetsecurity.com/2026/10/28/github-package-firewall-npm) that the firewall judges whether a version is new from the publish date in the package metadata.

## Dependabot reachability: labels and refresh frequency

[Reachability analysis](https://docs.github.com/en/code-security/concepts/supply-chain-security/about-reachability-analysis-for-dependabot-alerts) checks whether there is a call path from your code to a vulnerable function in a dependency. It uses CodeQL to build a call graph across the repository and its dependencies, and compares it with curated, per-advisory data on "vulnerable functions". Each open Dependabot alert gets one of four labels:

- Reachable: at least one call path exists. Up to five example paths are shown
- Potentially reachable: a call could not be ruled out. GitHub recommends treating it the same as reachable
- Unreachable: the analysis finished and found no path. You can lower its priority, but do not close it for this reason alone
- Reachability unavailable: unsupported language, analysis failure or timeout, and so on

The docs state that reachable is not the same as exploitable, and that "unreachable" is no guarantee of safety. The label never closes or dismisses an alert. It is meant to be used alongside other signals (severity, EPSS, whether the dependency is used in production).

Labels appear once right after you enable the feature, and after that they refresh only every 24 hours while open alerts exist. Pushing code does not start an analysis, and during the preview you cannot trigger one manually. Each analysis has a three-hour limit, so large monorepos or repositories with manifests in multiple directories may end up with no label.

Requirements: GitHub Enterprise Cloud, an npm, Yarn, or pnpm lockfile, and GitHub-hosted runners. Self-hosted runners are not supported. It is free during the preview, and Actions minutes are not billed.

In the Cloud Watch interview, Tempel said it "can filter out 90% of alerts". However, neither the changelog nor the docs mention that figure or the conditions behind it. How much it cuts in your own repositories is something you will only know after enabling it and looking at the distribution of labels.

## AI Scan: which languages it covers and how it affects merges

[AI Scan for pull requests](https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available) covers languages and formats CodeQL does not yet support. Examples include PHP, shell scripts, Terraform HCL, Dockerfiles, Java JSP, and C# Blazor. Findings appear in the same view as CodeQL results with an "AI" badge, sometimes with a suggested fix.

AI Scan findings are advisory. They do not fail the code scanning check, and you cannot use them as a merge-blocking condition in rulesets. It does not run on pull requests from forks or on pull requests created by Dependabot. You can add AI Scan without changing your current review flow.

On October 28, [AI Scan for repositories](https://github.blog/changelog/2026-10-28-ai-scan-for-repositories-in-public-preview) entered public preview. It scans the latest commit on the default branch within a fixed time window. It does not re-report issues CodeQL has already reported. Merging a fix does not close the alert automatically. You run the scan again to close it. Neither version of AI Scan needs a Copilot license, but both consume AI credits for Code Security.

## AI credits for Agentic autofix and push protection

When you assign a code scanning alert to Copilot, [Agentic autofix](https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability) examines the related files and writes a fix. It reruns CodeQL to verify the fix, then opens a draft pull request. It can fix up to 25 alerts in one pull request, but only alerts on the default branch. Once enabled, an "Assign to Copilot" button replaces the free "Generate Fix" button. An enterprise owner has to allow it by policy and set up how Copilot is billed.

[AI-powered push protection for secrets](https://github.blog/changelog/2026-10-28-push-protection-beyond-predefined-secret-patterns) also catches secrets that have no fixed format, judging from how they are used in the surrounding code, and rejects the push. GitHub says that in early results, the number of pushes blocked for secrets more than doubled. It is off by default, and you can add it in repositories that have both AI-powered secret detection and push protection enabled. The changelog also says agents need permission to bypass a block. Alerts from AI detection after a push still cost nothing extra, as before.

All three appear as "Advanced Security" under "AI usage" on the Enterprise billing page. The AI credit SKUs differ, though. AI Scan and Agentic autofix use AI credits for Code Security, and AI-powered push protection uses AI credits for Secret Protection. [The billing documentation](https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security) advises setting a budget cap before enabling each one.

## The Git infrastructure overhaul is still in private preview

Universe also announced a rebuild of how Git data is stored. [GitHub's blog](https://github.blog/news-insights/company-news/github-universe-2026-evolving-every-layer-of-the-stack/) says it expects to finish moving to multiple Azure regions early next year, and lists principles for the new Git design such as "separating storage and compute" and "reducing coordination". According to Cloud Watch's session report, the new infrastructure was shaped by feedback from early adopters, and a private preview started at the same time as the announcement. At this stage, nothing has been said about users needing to change any settings.

## What to check next

If you have a GitHub Enterprise Cloud contract and use npm, you can try package firewall and reachability analysis for free during the preview. For package firewall, start by pointing the `.npmrc` of a single CI runner at the firewall. Seeing how much the default minimum age (1 day) blocks tells you how much effort exception requests will take. For reachability analysis, one sensible order is to enable it for a subset of repositories through your organization's security configuration, check the share of "unreachable" labels, and then expand.

For the features that consume AI credits, set a budget before you enable them. Put the budget for AI Scan and Agentic autofix on AI credits for Code Security, and the budget for push protection on AI credits for Secret Protection. Push protection can consume credits even on pushes where no secret was found. Since AI Scan findings never block a merge, it is also worth deciding who will judge how to act on them.