The e-mail seems clear: Someone enabled the feature in the organization. The feature was in free preview, but the free preview is ending. If they leave it enabled, it will be billed at the new rate.
It's pretty clear that "organization" is being used throughout the e-mail, so they're not referring to this person's free personal GitHub account.
https://docs.github.com/en/code-security/concepts/about-code...
> GitHub Code Quality is currently in public preview and will become generally available on July 20, 2026. During public preview, Code Quality scans will consume GitHub Actions minutes but you will not be billed for other usage. From July 20, 2026, usage will incur additional charges. See GitHub Code Quality billing.
>If you want to avoid charges, disable Code Quality before July 20, 2026. See Disabling GitHub Code Quality.
https://docs.github.com/en/code-security/how-tos/maintain-qu...
>( Repo > Settings > Code Quality)
I don't see that tab, so either the docs are out of date, and it's called something else now, or it's not on all accounts/all repos. (Due to being in preview?) I don't know.
Correct. It's only for certain plans like GitHub Team and Enterprise Cloud.
The weird part about this e-mail is that they said they recently left some organizations because "the tone of the paid services" increased. So either they're still a member of one of these organizations, or GitHub mistakenly sent the e-mail to past members?
For those lucky 10,000 just learning about that today, for extra frisson, enjoy the fact that that video came from Microsoft itself: https://www.engadget.com/2006-03-15-microsoft-we-created-the...
It's not even available on personal free plans like the person says they have. Either the e-mail was sent in error, or it's enabled by someone else in an organization they're a member of.
Everything else about the e-mail is clear that it's about the organization, though. I don't know why this person would think they're going to start getting bills "per committer" of the organization where they're not already the responsible party for billing. Like GitHub just decided that they're going to start billing this one person for every committer in the org, but only for this one feature?
Someone appears, gives you a service unprompted(carries your bag of spams some AI code reviews), them later demands payment.
It's not a small print somewhere, or one of these weekly app store subscriptions that run up high bills because someone clicked "Yes" in a game.
It's like calling a Netflix renewal email a "shakedown" just because they send you an email giving you a heads up that your trial will convert into a paid subscription.
It must be some organization you're a member of.
I guess if you signed up for a cell phone contract and didn’t pay after the first month, and didn’t have a billing method set, it would go to collections. Things like that are generally uncommon though. It usually only happens with things like medical services, loans, auto repair, home repair/contractor services, and contractual services such as cell phone plans and utilities. (Contractors and mechanics may actually take out a lien.) Usually this only happens when there’s larger sums of money at stake or when it’s a large company with an airtight contract and a well-staffed billing department.
Things like consumer software subscriptions don’t usually involve this risk, there have been exceptions but consumers don’t like it and tend to punish it.
I always expect a failed billing or no billing info after a trial to cancel and not be pursued (I regularly do trials with a temp card that I immediately de-activate so it cannot be billed in case I forget to cancel)
They haven't demanded that of me. I have 2FA with a Yubikey and a TOTP app.
I don't ever recall giving them my phone number.
As a matter of fact GH even has a red "Less secure" badge on the SMS 2FA in the settings discouraging its use, as well as the following text in the description: "We strongly advise against using SMS because it is susceptible to interception, does not provide resistance against phishing attacks, and deliverability can be unreliable."