Anyone else seeing surprise github security charges?

[iskhakcodes]

running into something odd and trying to sanity-check before opening a support ticket.

i’m seeing line items for:

• Code Security (3 licenses – $2.90)
• Secret Protection (3 licenses – $1.84)

trying to figure out:

• which org or repos are actually generating these charges
• which specific features are enabled (code scanning, secret scanning, push protection, dependabot, etc)
• which users count toward the 3 licenses
• when these were enabled and by whom
• whether there’s a repo-level or user-level breakdown anywhere in the UI

i’ve checked the billing page and org settings, but everything feels pretty aggregated and it’s not obvious what flipped the switch.

has anyone managed to trace this cleanly without going straight to github support?
looking for real-world tips on where to dig or what usually causes this.

[wkkkis]

yeah, this usually comes from advanced security getting enabled somewhere

seen this a few times those two SKUs (“Code Security” + “Secret Protection”) normally mean GitHub Advanced Security–type features were turned on for private repos in an org you own or belong to.

the “3 licenses” part is key: github bills per unique active committers in repos where those features are enabled during that billing window.

so it’s almost never random it’s:

someone enabled security → 3 people (or bots) pushed → licenses appeared.

---

where to actually trace it

a few places that usually surface the truth:

billing → usage

go to:

account / org settings → Billing & plans → Usage

look specifically for:

• Advanced Security
• Code Security
• Secret Protection

that view usually tells you which org generated the charges.

---

org audit log (super important)

inside the org that’s being billed:

Org settings → Audit log

filter for stuff like:

• advanced_security.enable
• secret_scanning.enable
• code_scanning.enable
• push_protection.enable

that normally shows who flipped the switch and when.

---

repo-level toggles

open a suspect repo:

Repo → Settings → Security & analysis

check whether paid features are on:

• code scanning
• secret scanning for private repos
• push protection
• advanced dependabot features

sometimes these get enabled org-wide by default.

---

who the 3 users probably are

usually:

• devs with write access who committed
• CI bots that pushed code
• service accounts

all of those can count as “committers” for billing.

there’s often a breakdown in:

Org → Billing → Usage → Advanced Security

not perfect UI, but you can usually correlate names.

---

how to avoid it going forward

couple practical guardrails:

• don’t enable security org-wide unless you really mean it
• keep advanced security off on low-risk repos
• isolate bots
• review billing usage monthly
• set spending alerts
• restrict who can toggle security features

---

real talk

the UX around “this costs money” is… optimistic at best.
easy for someone to click-enable in settings and forget about it until the invoice shows up.

if the UI still won’t give repo-level detail, support can that’s usually the fastest way to get a precise breakdown.

---

tl;dr

• charges = advanced security features enabled somewhere
• 3 licenses = 3 active committers
• check billing usage + org audit log
• repo toggles matter
• bots can count
• support can give repo-level details if needed

curious if anyone else has found a cleaner in-product breakdown than audit logs so far.