Comparisons GitHub Advanced Security
GitHub secret scanning alternative for Supabase apps
GitHub scans your commits for secrets matching patterns its partners publish, and push protection can reject the push before the secret lands. On public repositories both are free. On private repositories they are GitHub Secret Protection, and the code-scanning half — CodeQL — is a separate product called GitHub Code Security. It is genuinely good at what it does, and what it does is match known key formats against your git history. It has no model of your database, your policies or your buckets, and it never looks at the site you deployed.
Where GitHub Advanced Security wins
Push protection is the single best security feature in this comparison and Sentris has no answer to it. Stopping a key at the moment somebody tries to push it beats finding it afterwards, every time. Turn it on. It is free on public repositories, it takes one click, and nothing on this page is a reason not to.
Side by side
| GitHub Advanced Security | Sentris | |
|---|---|---|
| Blocks the push before a secret lands | ■ yes | — no |
| Sweeps the full git history | ■ yes | — no |
| Free on public repositories | ■ yes | ◧ partly |
| Recognises hundreds of partner key formats | ■ yes | ◧ partly |
| Secrets in the deployed client bundle | — no | ■ yes |
| Tables shipping without RLS | — no | ■ yes |
| Policies granting using (true) | — no | ■ yes |
| Public Supabase storage buckets | — no | ■ yes |
| Routes taking an id with no auth check | ◧ partly | ■ yes |
| Flat price regardless of team size | — no | ■ yes |
| Price | Free on public repos; private repos $19 per active committer / month (Secret Protection), $30 (Code Security), $49 for both | Free to scan; $19 / month flat for findings and fixes |
Prices checked 30 July 2026 against each vendor's public pricing page. Check theirs before deciding — ours is on this page.
Choose GitHub Advanced Security if
- You want the secret stopped at push time, not reported later.
- Your repositories are public — you get all of this for nothing.
- You want your whole git history swept for secrets that leaked years ago.
- You want CodeQL's general vulnerability analysis across the codebase.
- You are on GitHub Enterprise and it is already paid for.
Choose Sentris if
- You want to know what your deployed bundle is exposing, which is not a question about your repository.
- Row Level Security, policies and storage buckets are the exposure you actually have.
- Per-active-committer pricing on a private repo costs you more than a flat $19.
- You want the fix, not a flagged line.
- You want a scan before you commit to anything, without an account.
Questions
GitHub already scans for secrets. Why would I need this?
Because the most common way a service_role key reaches the public is not a commit. It is a NEXT_PUBLIC_ environment variable: the key is never a literal in your source, so there is nothing in your git history to match, and it appears for the first time in the JavaScript bundle you deployed. Secret scanning reads your repository. Sentris also fetches what your server is handing to every visitor.
Is secret scanning free?
On public repositories, yes — scanning and push protection both. On private repositories it is GitHub Secret Protection at $19 per active committer per month, measured over a 90-day window.
Does Sentris replace CodeQL?
No. CodeQL is general-purpose vulnerability analysis across a whole codebase; Sentris runs four specific checks about Supabase access control and exposed keys. Different scope, and the overlap is small enough that running both is reasonable.
One number nobody else on this list publishes
False-positive floods are the standing complaint about this whole category, and not one tool in it states its rate. Ours is precision 1.000, recall 1.000 over 24 planted findings in 9 repositories — with the date, the commit, the scoring rules and the command that reproduces it, plus a paragraph on why 9 repositories is a small corpus. Measured 2026-08-03.
Find out in about a minute.
A scan needs no account and no card. You see how many exposures you have before you decide whether any of this comparison matters.
Scan my app