GitHub Advanced Security vs GitLab Ultimate when security testing comes with the source host

One vendor bills security per active committer who pushed in the last 90 days, the other bills every user on the instance at the top plan. That metering choice decides more budgets than scanner accuracy does. Both sell SAST, secret detection, dependency scanning, and merge-gating inside the source host. They split on how security is licensed against the platform.

GitHub sells GitHub Advanced Security as two products, Secret Protection and Code Security, with CodeQL, Copilot Autofix, push protection, and Dependabot. GitLab includes application security testing, software supply chain security, vulnerability management, and compliance in GitLab Ultimate, where all users in a group or instance must be on the same plan.

Buy GitHub Advanced Security when code already lives on GitHub and security should be licensed only for active committers. Buy GitLab Ultimate when one DevSecOps platform with security approvals, compliance, and self-managed options should cover the whole team.

Overview

	GitHub Advanced Security	GitLab Ultimate
Primary use case	Security add-ons for GitHub repositories: CodeQL code scanning, Copilot Autofix, secret scanning with push protection, and Dependabot and dependency review	Ultimate-tier security inside the GitLab DevSecOps platform: SAST, DAST, secret detection, container and dependency scanning, vulnerability management, and compliance frameworks
Day-to-day workflow	Enable Secret Protection and Code Security per repository or organization, review alerts in pull requests, accept Copilot Autofix suggestions, and track security overview dashboards	Add scanners through CI templates, review new findings in merge request widgets, require security approvals by policy, and triage in the vulnerability report
Main buying consideration	Secret Protection USD 19 and Code Security USD 30 per active committer per month on github.com/security/plans. Active committers counted over the last 90 days	Ultimate price on request on about.gitlab.com/pricing, checked 10 Oct 2026. Premium is USD 29 per user per month billed annually. All users in a namespace or instance must be on the same plan

We reviewed GitHub security plans and active committer billing documentation and the General Motors customer story, plus GitLab pricing, the pricing FAQ on scanner tiers, and GitLab application security documentation, on 10 Oct 2026. We did not run either platform in a paid tenant.

GitHub Advanced Security

GitLab Ultimate

Editions and pricing

GitHub prints two security SKUs on an active committer meter. GitLab prints Premium but not Ultimate, and Ultimate licenses every user rather than committers.

	GitHub Advanced Security	GitLab Ultimate
How it is sold	Secret Protection and Code Security as separate add-ons to GitHub Team or Enterprise, metered or by subscription for Enterprise	Free, Premium, and Ultimate plans on GitLab.com, Self-Managed, or GitLab Dedicated, with GitLab Credits for AI and usage features
Figure on the public page	USD 19 per active committer per month for Secret Protection and USD 30 for Code Security	USD 29 per user per month for Premium billed annually. Ultimate is a sales quote, with 24 included GitLab Credits per user per month
What the unit counts	Unique active committers who pushed to an enabled repository in the last 90 days	Every user in the namespace or instance on the same plan, with unlimited guest users on Ultimate

Scanning and findings

Both scan code, secrets, and dependencies in the merge flow. The split is a semantic code query engine on GitHub versus a scanner suite tiered across GitLab plans.

	GitHub Advanced Security	GitLab Ultimate
SAST object	CodeQL semantic analysis with default or advanced setup and Copilot Autofix suggestions in pull requests	Ultimate SAST with proprietary false-positive suppression and vulnerability tracking as code moves, plus customizable rulesets
Secrets	Secret scanning with push protection that blocks commits containing supported secrets before they land	Secret detection in pipelines and push protection, with custom rulesets on Ultimate
Free tier behavior	Public repositories get code scanning and secret scanning at no charge	Basic SAST, secret detection, and container scanning run on all tiers but output JSON artifacts only; merge request findings and the vulnerability report require Ultimate

Policy and governance

Both gate merges on security results. The documented split is rulesets and security overview versus security policies with approvals and compliance frameworks.

	GitHub Advanced Security	GitLab Ultimate
Merge gate	Repository rulesets and required code scanning results block merges on alerts above a severity	Merge request approval policies require security approvals when findings affect posture
Program view	Security overview across repositories with alert trends and coverage	Vulnerability report, dependency list, and compliance center across groups
Deployment	GitHub.com and GitHub Enterprise Server	GitLab.com, Self-Managed, and GitLab Dedicated single-tenant SaaS

Favor GitHub Advanced Security when the documented requirement is CodeQL, Copilot Autofix, push protection, and Secret Protection or Code Security billed only for 90-day active committers. Favor GitLab Ultimate when the documented requirement is the full scanner suite with merge request approval policies, the vulnerability report, compliance frameworks, and Self-Managed or Dedicated deployment on one plan.