Vulert vs GitHub Advanced Security

Vulert is a software composition analysis service that monitors an application open-source dependencies for known vulnerabilities without access to source code. Projects are added by uploading a manifest or lockfile, for example package-lock.json, yarn.lock, pom.xml, requirements.txt, go.sum, Cargo.lock, composer.lock or Gemfile.lock, or an SBOM in SPDX or CycloneDX format, which Vulert checks against its own vulnerability database. Alerts are delivered through the dashboard and email, with Jira, CI/CD, Slack or Discord and SIEM integrations listed among the platform features, and separately priced modules for Docker image scanning, open-source licence compliance and SBOM export. It is a hosted SaaS product requiring no agent, installation or repository connection, operated by Vulert LTD, a company registered in England.

Pros

• No source code access, agent or repository connection is required. The vendor states that only metadata such as SBOMs and manifests is analysed, which can suit teams whose code cannot leave the organisation.
• Pricing figures are published on the website rather than quote-only, starting at $20 per month, with a $0 evaluation tier and a stated 30-day free trial.
• The public scanner runs without signup, so detection output on a real manifest can be inspected before any purchase. The scanner page showed 493,778 vulnerabilities in the database, last updated 3 August 2026.

Things to check

Pricing: Trial $0 (1 user, up to 50 apps); Starter $20/month; Pro $45/month; Growth $125/month; Enterprises from $500/month. Annual billing lists $18, $39 and $110 for the three paid tiers. 30-day free trial stated.

GitHub Advanced Security (GHAS) is a native security suite built into the GitHub platform that provides code scanning (SAST via CodeQL), secret scanning, dependency review, and Dependabot for automated dependency updates. By embedding security directly into the GitHub pull request workflow, GHAS provides a seamless experience for teams already using GitHub as their source code management platform. GHAS is included free for public repositories and available as a paid add-on for GitHub Enterprise customers.

Pros

• Zero-friction integration for GitHub-native development teams
• Free for all public repositories including SAST and secret scanning
• CodeQL provides deep semantic analysis with custom query capabilities
• Secret scanning with push protection prevents credential leaks proactively
• Dependabot automates dependency updates with minimal configuration

Things to check

• Only available for GitHub repositories, creating platform lock-in
• No container image scanning beyond basic Dependabot alerts
• No IaC security scanning capabilities
• Per-committer pricing can be expensive for organizations with many contributors
• SCA capabilities are less comprehensive than Snyk's purpose-built analysis

Pricing: See the vendor site for current pricing.