Draugr and GitHub Advanced Security

What overlaps, what doesn't, and the two things GHAS does that Draugr can't. Prices checked 7 August 2026.

If you are looking at a GitHub Advanced Security bill and wondering what it would take to replace it, this page is the honest version of that answer. Some of it is encouraging and some of it isn't, and you should have both before you spend a sprint on it.

The short version

GHAS scans a repository. Draugr qualifies a release. They overlap on three controls and diverge everywhere else. Draugr covers a great deal that GHAS does not reach, including containers, infrastructure-as-code, live hosts, TLS, HTTP headers, licenses and SBOMs, and produces a single pass/fail verdict rather than a dashboard. GHAS does two things Draugr structurally cannot, and one of them may be the reason you keep paying for it.

What it costs

GitHub split Advanced Security into two products on 1 April 2025. List rates, per active committer per month:

Billing counts unique active committers over a rolling 90 days, not seats or repositories, so it grows with contributor churn rather than with headcount. Fifty active committers on both products is roughly $29,000 a year.

Draugr is Apache-2.0 and runs in your own CI, so the software costs nothing and the compute is whatever your runners already cost.

Where they overlap

That last row is worth knowing on its own. GitHub's Security tab accepts SARIF from any tool, without a GHAS license. Whatever you choose, you are not locked out of the interface.

What GHAS does that Draugr cannot

Two things, and neither is on our roadmap, because neither is a feature we are missing. They are consequences of where each tool runs.

Push protection

GHAS blocks a secret at push time, server-side, before it reaches the remote. Draugr runs in your pipeline, which is after the push by definition. A pipeline cannot reject a push that has already happened, so this is not something we will close. If push protection is why you bought Secret Protection, keep it, and note that it is the $19 product rather than the $30 one.

Interprocedural analysis

CodeQL compiles your code into a queryable database and tracks tainted data across functions and files. Semgrep's open-source edition analyses within a single function, so it will not follow a value from a handler, through three helpers, into a query. That is a real difference in what gets found, not a difference in configuration, and anyone telling you an OSS stack is "90% of GHAS" is quoting a number rather than a measurement.

Draugr's answer is that you are not restricted to the open-source default, since the sastcontrol takes whichever scanner you point it at, including ones you already pay for. But if CodeQL's depth is what you are buying, buy it.

What Draugr does that GHAS doesn't

This is the half that usually decides it, because it is not a cheaper version of the same thing. It is a different question being answered.

• Everything past the repository. Container images, infrastructure-as-code, Kubernetes posture, live hosts, TLS configuration, HTTP security headers, dependency licenses and SBOM generation. GHAS reads code; a release is more than code.
• A verdict, not a dashboard. Draugr exits non-zero on a fail, so it gates a pipeline directly. GHAS reports findings and leaves the decision to you and a policy you write elsewhere.
• Ranking that knows what is exposed. The same CVE is urgent on an internet-facing gateway and a backlog item on an internal tool. Draugr knows which is which because your descriptor says so; no scanner can infer it from the code.
• Gate on new findings only. draugr diff compares a branch against its base, so inheriting two hundred existing findings does not block every pull request.
• It is not GitHub-only. The same descriptor runs on GitLab, Azure Pipelines, Jenkins, or a laptop, with a first-party template for each and findings landing in that platform's own surfaces, whether GitLab's Vulnerability Report and merge requests, Azure's Tests tab and pull requests.

So which

Keep GHAS if push protection is load-bearing for you, or if CodeQL's depth on a large first-party codebase is what you are buying. Both are real, and no amount of open-source assembly replaces them.

Look at Draugr if the bill is mostly buying you scanners you could run yourself, if your risk lives in images and infrastructure as much as in source, or if what you want is one answer to "can this ship?" rather than three dashboards to reconcile.

Both is reasonable. They are not mutually exclusive, and Secret Protection for push-time blocking and Draugr for everything a release needs before it goes out is a coherent setup, and cheaper than the pair.

Trying it takes two commands

$ curl -fsSL https://draugr.dev/install.sh | sh
$ draugr scan .   # sca, secrets, sast, iac, no descriptor needed

That is the zero-config path against any repository. When you want the rest, meaning images, hosts, TLS, headers and infrastructure, draugr init writes a descriptor by detecting your stack. The documentation starts there, and Learnexplains the controls themselves if any of the acronyms above were doing heavy lifting. There is also a comparison with Snyk, and the rest are listed together.