GitHub Dependabot — free
Keep this one.
Continuous alerts for known vulnerable dependencies across every repo, from GitHub, for $0. That's the only scanner you need — because the other kind of checking moves inside the Job.
Compare
Do you still need paid GitHub security tools?
The free parts — Dependabot alerts, basic code scanning — cost nothing, keep them. The paid Advanced Security seats are covered: a FalseGreen Job does the checking and gates the merge.
What GitHub review, CodeQL, and rulesets does
What it does well.
- Dependabot dependency alerts — free for public and private repos
- Rulesets that require checks before merge
- CodeQL: a serious SAST engine, free at the basic tier
The replacement
Free Dependabot + one FalseGreen Job covers GitHub review, CodeQL, and rulesets.
FalseGreen Job — before merge
This replaces GitHub review, CodeQL, and rulesets.
Where you’d pay for Copilot review or Advanced Security: the Job runs CodeQL-class analysis (Semgrep engine), checks dependencies with fixes named, and blocks rather than alerts.
The feature matrix
FalseGreen vs GitHub review, CodeQL, and rulesets, line by line.
| Capability | FalseGreen | GitHub |
|---|---|---|
| Primary purposeThe main problem the product is designed to solve. | Independent whole-program acceptance | Repository review, analysis, and merge controls |
| Continuous PR or code reviewReviews changes continuously in the normal developer workflow. | ✓ Yes | ✓ Yes |
| Dedicated security or static analysisSpecialized analysis for code quality, vulnerabilities, or security findings. | ✓ Yes | ✓ Yes |
| Frozen human-defined definition of doneThe frozen acceptance target is established before implementation is judged. | ✓ Yes | ◐ Partial |
| Separate Job acceptance authorityA distinct authority decides whether the FalseGreen Job is accepted. | ✓ Yes | — Not primary |
| Job or outcome-level acceptanceAnswers whether the whole program meets the agreed definition of done. | ✓ Yes | — Not primary |
| Exact-source-bound acceptanceAcceptance belongs explicitly to the exact source state that earned it. | ✓ Yes | ◐ Partial |
| Repair against unchanged requirementsRepairs can be reverified while the original acceptance target remains frozen. | ✓ Yes | ◐ Partial |
| Heterogeneous evidence for acceptanceTests, CI, scanners, formal tools, behavior, and inspection can inform one Job decision. | ✓ Yes | ◐ Partial |
| Explicit verdictReturns Accepted, Failed, or Insufficient Evidence for the verified program. | ✓ Yes | ◐ Partial |
| Exact-source enforcementCan enforce an issued decision against the current source state. | ✓ Yes | ✓ Yes |
FalseGreen
- Primary purpose
- Independent whole-program acceptance
- Continuous PR or code review
- ✓ Yes
- Dedicated security or static analysis
- ✓ Yes
- Frozen human-defined definition of done
- ✓ Yes
- Separate Job acceptance authority
- ✓ Yes
- Job or outcome-level acceptance
- ✓ Yes
- Exact-source-bound acceptance
- ✓ Yes
- Repair against unchanged requirements
- ✓ Yes
- Heterogeneous evidence for acceptance
- ✓ Yes
- Explicit verdict
- ✓ Yes
- Exact-source enforcement
- ✓ Yes
GitHub code review, CodeQL, and rulesets
- Primary purpose
- Repository review, analysis, and merge controls
- Continuous PR or code review
- ✓ Yes
- Dedicated security or static analysis
- ✓ Yes
- Frozen human-defined definition of done
- ◐ Partial
- Separate Job acceptance authority
- — Not primary
- Job or outcome-level acceptance
- — Not primary
- Exact-source-bound acceptance
- ◐ Partial
- Repair against unchanged requirements
- ◐ Partial
- Heterogeneous evidence for acceptance
- ◐ Partial
- Explicit verdict
- ◐ Partial
- Exact-source enforcement
- ✓ Yes
Also comparing