Understand Security Campaigns
Modern application security in GitHub Advanced Security is built around continuous detection and remediation of risks across your codebase. As developers commit code, open pull requests, and update dependencies, GitHub automatically analyzes repositories and surfaces security findings. These findings typically appear as alerts generated by built-in security features, such as:
- Code scanning, which identifies vulnerabilities in application code using static analysis
- Secret scanning, which detects accidentally committed credentials or sensitive data
- Dependency scanning, which highlights known vulnerabilities in open-source dependencies
Each of these features produces alerts at the repository level, giving teams visibility into potential risks. However, in organizations with many repositories and contributors, these alerts can quickly accumulate.
Instead of addressing each alert individually, organizations often need a more structured approach to manage risk at scale.
From individual fixes to coordinated efforts
At a small scale, developers can resolve security issues as they appear-fixing a vulnerable dependency, removing an exposed secret, or addressing a code scanning finding.
At scale, this approach becomes difficult to sustain.
For example:
- The same type of vulnerability might appear across multiple repositories
- Large backlogs of alerts can build up over time
- Different teams might prioritize and resolve issues inconsistently
A security campaign is a way to organize and coordinate remediation efforts across repositories and teams. Rather than focusing on individual alerts in isolation, a campaign groups related work into a shared objective, such as reducing a specific type of vulnerability or addressing a backlog of high-severity alerts.
This approach allows organizations to:
- Focus on the most impactful risks
- Align multiple teams around a common goal
- Track progress over time using consistent metrics
When organizations need coordinated campaigns
Security campaigns are most useful when security work needs to be coordinated across multiple repositories or teams.
Common scenarios include:
- High alert volume Large numbers of alerts-such as dependency vulnerabilities-can make it difficult to prioritize and act effectively.
- Repeated vulnerability patterns The same issue, such as insecure coding patterns or outdated dependencies, appears across multiple projects.
- Organization-wide exposure A class of risk affects many repositories, requiring a consistent and coordinated response.
In these situations, treating each alert independently can lead to fragmented efforts. A coordinated approach helps ensure that remediation is consistent, measurable, and aligned with organizational priorities.
How GitHub surfaces security signals
Security campaigns operate on top of security alerts already surfaced across GitHub repositories.
GitHub provides centralized ways to view and manage these security alerts across an organization. Security findings are surfaced through:
- Repository-level security views for individual projects
- Organization-level views that aggregate alerts across repositories
- Filtering and grouping capabilities based on severity, ecosystem, repository, and alert type
These capabilities make it possible to:
- Identify patterns across repositories
- Understand the overall security posture of an organization
- Prioritize remediation efforts based on risk
These security signals form the underlying data that campaigns act upon to coordinate and track remediation efforts at scale.