You Never Had the Scans GitHub Just Paywalled

GitHub's July 14 changelog announced AI security detections for Shell, Dockerfiles, Terraform, and PHP on pull requests, but access requires a GitHub Code Security (Advanced Security) subscription, a Copilot license, and metered AI credits per run. The detections cover ecosystems CodeQL never analyzed, but free deterministic linters like ShellCheck, Hadolint, and tfsec have long provided equivalent coverage without cost.

Security https://sourcefeed.dev/c/security Article You Never Had the Scans GitHub Just Paywalled New AI detections need a GHAS seat, a Copilot license, and metered credits — deterministic linters need none. Ji-ho Choi https://sourcefeed.dev/u/jiho choi A one-sentence GitHub changelog https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/ on July 14 announced AI security detections on pull requests — and lit up dev forums with a familiar accusation: GitHub put Shell, Dockerfiles, Terraform, and PHP scanning behind a paywall. The framing is catchy, and it's already spawned a free counter-Action. It's also only half true, and the half that's true is more interesting than the outrage. Start with what actually shipped. Per GitHub's March announcement, the new detections cover Shell/Bash, Dockerfiles, Terraform HCL, and PHP — ecosystems CodeQL has never analyzed, on any tier. Nothing was taken away from anyone. What's new is that the coverage arrives triple-gated: you need a GitHub Code Security Advanced Security subscription, a Copilot license, and the detections draw down your organization's metered AI credits every time they run. An enterprise owner has to allow the preview before an org can even turn it on. The paywall isn't the story. The meter is. Developers aren't wrong to feel stung, because these four file types aren't exotic — they're the connective tissue of every CI/CD pipeline. Your deploy scripts, your container builds, your infrastructure definitions. GitHub choosing exactly this surface for its first AI-detection product, and pricing it as a stacked SKU, tells you where application security tooling is heading: away from flat-rate licenses and toward metered AI consumption. That's a genuine shift in how security budgets work. CodeQL analysis for its supported languages comes with the GHAS seat — predictable cost. AI detections run on every PR and bill per run. A monorepo with heavy PR traffic now has a security line item that scales with velocity, not headcount. GitHub's own justification is that these ecosystems are "difficult to support with traditional static analysis" — its internal testing processed over 170,000 findings in 30 days with 80%+ positive developer feedback. That's a self-reported satisfaction number, not a precision or recall benchmark, and GitHub hasn't published one. The findings are labeled "AI" in the UI and don't block merges, which is the appropriate posture for a detector of unknown precision. The free floor has existed for a decade Here's the part the outrage skips: nobody needed GitHub for this coverage, before July 14 or after. ShellCheck https://www.shellcheck.net/ has been catching unquoted variables and word-splitting bugs since 2012 and sits at 39k+ GitHub stars. Hadolint lints Dockerfiles against Docker's own best practices — running as root, unpinned base images, curl | sh . tfsec flags open security groups and unencrypted state in Terraform. All deterministic, all free, all installable in one CI step. The dev.to post that popularized the paywall framing ships ghas-free-pack https://github.com/Booyaka101/ghas-free-pack , a Docker-based Action wrapping ShellCheck, Hadolint, tfsec, and optionally PHPStan into a unified SARIF 2.1.0 report, a single self-updating PR comment, and an exit code branch protection can act on. It's a genuinely sensible packaging job — one workflow step instead of four, findings grouped in one place: - uses: actions/checkout@v7 - uses: Booyaka101/ghas-free-pack@v1 with: github-token: ${{ github.token }} One honest caveat before you paste that in: the Action is days old, single-maintainer, with effectively no community track record yet. The scanners underneath are battle-tested; the wrapper isn't. Pin it to a commit SHA or fork it — standard hygiene for any young third-party Action with pull-requests: write permissions. Where the free stack actually falls short Three trade-offs the "just use linters" crowd glosses over. First, deterministic linters and AI detections aren't substitutes. ShellCheck catches syntactic hazard patterns; it will never trace a tainted environment variable through three functions into an eval . If GitHub's LLM-based detections work as advertised, they find a different class of bug. The problem is "as advertised" — with no public benchmark, you can't know whether the AI layer finds things the free linters miss or expensively re-discovers SC2086 . If you're already a GHAS-plus-Copilot shop, the right experiment is cheap: run the four linters as a baseline for a month, enable the preview, and diff the findings. If the AI column is mostly duplicates, you have your answer and your credits back. Second, the free pack's PHP story is weaker than it looks. PHPStan is an excellent bug-finder, but it's a type checker, not a security scanner. For actual taint analysis in PHP — user input flowing into SQL or echo — the free tool you want is Psalm https://psalm.dev/ with --taint-analysis . And tfsec, while still functional, is in maintenance: Aqua folded its engine into Trivy https://trivy.dev/ , where new rules now land. A greenfield setup should reach for trivy config directly. Third, the code-scanning dashboard itself is part of the paywall. SARIF upload to the Security tab is free on public repos but requires GHAS on private ones — the free pack degrades to PR comments there. That's less painful than it sounds, since the PR comment and a failing check are where developers actually see findings, but if you wanted the org-wide security overview, that was never free for private code and still isn't. The verdict For public repos and OSS: wire the linters, take the free code-scanning UI, done. For private repos without GHAS: the linter stack plus branch protection gives you 80% of the value at 0% of the cost, and it's honestly negligent not to have ShellCheck and Hadolint in CI in 2026. For GHAS customers: treat AI detections as an experiment you're funding, not a product with proven precision — measure it against the free baseline before letting it consume credits on every PR. The lasting significance isn't this feature. It's the pricing template: security scanning as metered AI spend, stacked on top of two existing licenses. Every vendor in the space is watching whether developers accept that. The best leverage you have is knowing the deterministic floor is free — and putting it in first. Sources & further reading - GitHub put Shell, Dockerfiles, Terraform and PHP behind a paywall. Here's a free Action that scans them. https://dev.to/booyaka101/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-heres-a-free-action-that-scans-46m8 — dev.to - Code scanning shows AI security detections on pull requests https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/ — github.blog - GitHub expands application security coverage with AI-powered detections https://github.blog/security/application-security/github-expands-application-security-coverage-with-ai-powered-detections/ — github.blog - ghas-free-pack: free security scanning for Shell, Dockerfiles, Terraform and PHP https://github.com/Booyaka101/ghas-free-pack — github.com - GitHub adds AI-powered bug detection to expand security coverage https://www.bleepingcomputer.com/news/security/github-adds-ai-powered-bug-detection-to-expand-security-coverage/ — bleepingcomputer.com Ji-ho Choi https://sourcefeed.dev/u/jiho choi · Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. Discussion 0 No comments yet Be the first to weigh in.