GitHub Advanced Security — quick notes

| Platform | Default | Advanced | |---|---| | GitHub CodeQL | Managed configuration; no workflow file | Editable GitHub Actions workflow, including manual build control | | Azure DevOps CodeQL | Scheduled Azure Pipelines scans | CodeQL tasks and build control in the team's pipeline |

• Azure Repos do not need migration or mirroring; findings appear in Azure DevOps's Advanced Security tab.
• Secret scanning detects existing exposure; push protection blocks supported secrets by default, subject to governed bypass.
• GitHub dependency review evaluates pull-request changes; Azure DevOps dependency scanning is pipeline-based.

Primary sources: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security · https://learn.microsoft.com/en-us/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/repos/security/github-advanced-security-security-overview?view=azure-devops · https://docs.github.com/en/code-security/concepts/code-scanning/setup-types · https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-for-compiled-languages · https://docs.github.com/en/code-security/concepts/secret-security/push-protection · https://docs.github.com/en/code-security/concepts/supply-chain-security