---
title: "Five Committers Billed for a CodeQL Scan That Last Ran May 22"
canonical: https://dxdev.com/blog/security-billing-outlived-the-tool/
datePublished: 2026-08-20
---
The last CodeQL scan on that repo ran May 22, and GitHub Advanced Security was still billing us for five committers. When a surprise charge showed up, we noticed the amount looked wrong and pulled the thread. The mechanism below can bite anyone running CodeQL or Semgrep through GitHub Actions.

## Removing the workflow turned off nothing

In May, during a CI hardening pass on our main repo, we turned on GitHub Advanced Security to unblock SARIF uploads from CodeQL and Semgrep. Three days later, a follow-up ticket ripped the CodeQL workflow back out for unrelated reasons, and it was gone from the YAML.

That was the wrong turn, and it cost us three months. We treated deleting the workflow as the same thing as turning the feature off. Advanced Security is a repository-level license toggle, separate from whatever GitHub Actions steps call into it. Deleting the workflow deleted the thing that used the feature. The feature itself, and its billing, stayed where we left it. GitHub bills per active committer on any repo where the setting is enabled, whether or not a single scan runs.

So five committers were billed against that repo every month for a tool that scanned nothing and produced zero alerts. Three months of that added up to real money spent on a setting nobody remembered existed.

## Reading the receipt

The diagnostic path was short. Someone finally read the invoice line instead of routing it past themselves. Once the amount looked off, we pulled the repo's security tab and confirmed the last scan date. Then we cross-referenced it against the billing API's committer count for that repo. Last scan May 22, five billable committers, feature still flagged on. That was the whole investigation.

The fix took longer to verify than to apply. Disabling Code Security on the one repo is a single settings toggle. Confirming it was only that repo meant walking all 13 repos in the org and checking each one's Advanced Security status against the billing API's per-repo committer counts. The org's other two active repos still run real scans (25 open alerts, 65 fixed, a real history), and turning those off by mistake would have been a worse problem than the one we were fixing. Before touching anything, we pulled a full alert snapshot on those two repos as a rollback record, in case the toggle had any side effect on existing findings. It didn't have one.

Billable committers on the dead repo went from 5 to 1. GitHub apparently still counts something even when the feature is fully disabled. The monthly cost fell to about a fifth of what it had been. We filed a support ticket asking for a credit on the June-through-August charges, and we asked for most of it back. GitHub's own docs say they don't refund the current month's consumed licenses, so the realistic number is smaller than what we asked for. The ticket is open.

## The one lane with no cap

This org already has hard spend caps set to zero on `actions`, `packages`, `codespaces`, `git_lfs`, and `ai_credits`. Those categories cannot silently accrue cost past zero without an explicit budget raise. Advanced Security has no such cap available, at least not as a first-class budget category in GitHub's billing settings the way the others are. That product gap is why a monthly charge ran for three months with nobody noticing. Every other spend lane in that org has a tripwire, and this was the one that didn't.

An obvious fix is to audit the billing dashboard monthly. That is the same failure with a calendar reminder bolted on. It depends on a human remembering to look at a page that doesn't demand attention, and the page already went unlooked-at once for three months.

We haven't built the workaround yet. It would be a small scheduled check that walks the org's repos, cross-references Advanced Security status against committer counts and last-scan timestamps, and flags anything billing on a feature with no recent activity. That is a script, because GitHub doesn't give you the setting. If you have the same five hard caps configured and a sixth line item you've never looked at, the caps you set are the only ones protecting you.

Removing a scanning workflow does not turn off the Advanced Security setting, and GitHub keeps billing per active committer on any repo where it stays enabled.