GitHub has raised the license ceiling for its self‑serve Advanced Security (GHAS) trial from 100 to 300 seats, allowing any GitHub Enterprise Cloud organization under that size to spin up a 30‑day, no‑sales‑talk trial of both Code Security and Secret Protection directly from the billing page.
Eligibility and trial mechanics
The new limit expands the trial audience from early‑stage teams to mid‑size engineering groups that typically manage dozens of repositories and a growing secret surface. Activation is performed in the “Billing and licensing” section of the enterprise settings; no purchase order or sales conversation is required. Once started, the organization can add an unrestricted number of committers and enable both security features across every repository it owns. The trial expires automatically after 30 days if no purchase is made, and a subsequent attempt is blocked for 180 days.
Why the change matters to engineers
For AI engineers, platform engineers, SREs, and security practitioners the key benefit is the removal of procurement friction. Teams can now evaluate how quickly Secret Protection blocks exposed credentials at the moment of a pull request and how CodeQL flags vulnerable patterns in a live codebase, without waiting for a sales cycle. This is especially relevant as AI‑assisted coding tools increase commit velocity, making real‑time blocking a more meaningful metric than a summary report at the end of a trial.
Architectural and operational implications
Enabling GHAS at scale introduces several considerations:
- Commit‑time enforcement: Secret Protection can reject a PR before the secret is merged, which may affect existing CI pipelines that assume all code reaches the repository before scanning.
- CodeQL scan scope: Activating Code Security across all repos triggers a full dependency graph analysis, potentially increasing compute usage and generating false positives that need triage.
- Configuration overhead: The trial period is short; teams must allocate time in the first week to provision the tools, define exclusion patterns, and calibrate alert thresholds.
- Cooldown period: After a trial expires, the organization must wait 180 days before re‑trying, so the initial run should be treated as a definitive evaluation.
What to watch and evaluate next
Practitioners should focus on the following during the 30‑day window:
- Identify a representative set of production‑traffic repositories and those with complex dependency trees; these will surface the most relevant findings.
- Measure the latency between a secret being introduced and the block action taken by Secret Protection; compare this to the commit rate of your AI‑generated code.
- Track the volume and severity of CodeQL alerts, and assess the effort required to triage false positives versus true vulnerabilities.
- Plan a decision checkpoint in the final week of the trial to decide on purchase, based on quantitative data collected rather than a single end‑of‑trial report.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Mid‑size engineering orgs can now test GHAS without a procurement gate, giving them a realistic view of how real‑time secret blocking and code‑level vulnerability scanning behave under their actual commit load. The practical takeaway is to treat the trial as a short‑run production experiment: configure early, focus on high‑risk code, and use the block‑at‑commit signal as the primary success metric.
