| 1 | --- |
| 2 | title: What's free and what's paid |
| 3 | description: Which security features are free everywhere, which are free on public repositories, and Security and quality, which comes with the g1t plan for private ones. |
| 4 | --- |
| 5 | |
| 6 | Keeping secrets out of repositories and vulnerable dependencies out of |
| 7 | production is free, everywhere. The rest of the security suite is free on |
| 8 | public repositories and comes with the g1t plan, as **Security and |
| 9 | quality**, on private ones. |
| 10 | |
| 11 | | Feature | Public repositories | Private repositories | |
| 12 | | --- | --- | --- | |
| 13 | | Secret scanning and push protection | Free | Free | |
| 14 | | Bypassing push protection with a reason | Free | Free | |
| 15 | | Vulnerability alerts | Free | Free | |
| 16 | | Security updates | Free | Free | |
| 17 | | Dependency graph and SBOM | Free | Free | |
| 18 | | Custom patterns | Free | With the plan | |
| 19 | | Validity checks | Free | With the plan | |
| 20 | | Delegated bypass | Free | With the plan | |
| 21 | | Code scanning | Free | With the plan | |
| 22 | | Dependency review | Free | With the plan | |
| 23 | | Security overview | Free | With the plan | |
| 24 | |
| 25 | ## Security and quality |
| 26 | |
| 27 | Security and quality has no price of its own. It is on for every private |
| 28 | repository of a workspace on the [g1t plan](/guides/usage-and-billing/#the-g1t-plan), |
| 29 | and what it runs is charged like everything else g1t runs: security scans |
| 30 | at what they cost g1t plus 20%, from the plan's included usage first. There |
| 31 | is nothing to turn on. |
| 32 | |
| 33 | Scanning itself (history scans and dependency reads) is metered, and |
| 34 | covered by g1t on free workspaces. |
| 35 | |
| 36 | A Security and quality subscription a workspace has at Stripe is ended by g1t, |
| 37 | without a charge for the next month. Workspaces whose billing g1t covers, |
| 38 | and an enterprise's workspaces, have it included. |
| 39 | |
| 40 | Without the plan, a private repository's paid features say what they need |
| 41 | and who can start the plan; nothing is started without an owner choosing |
| 42 | it. |