GitHub published a security extension for the GitHub Copilot app that lets you review, explain, and fix code scanning alerts without leaving the app. It also adds /security-review to review changes you haven’t pushed yet, and fixes are written only to your local copy: nothing gets committed, nothing gets pushed, and no pull request opens.
Status at the time this note was published (October 31, 2026): the extension is in public preview and may change. GitHub hadn’t announced a general availability date, and the per-plan requirements you’ll see below are what’s most likely to change when it exits preview.
What is the GitHub Copilot security extension?
It’s a plugin published by GitHub, called github-security and distributed through awesome-copilot, that adds a Security canvas to Copilot app sessions. From that canvas you can:
- See the open code scanning alerts from a repository, sorted by severity, with search and filters.
- Open an alert to see its description, severity, and affected code, or jump to the full alert page on GitHub.
- Select one or more alerts and ask Copilot to explain them (Explain) or fix them (Fix).
- See linked pull requests to know if someone is already working on the fix.
- Dismiss alerts you don’t plan to fix.
- Run
/security-reviewon your current changes and see the findings alongside existing alerts.
You can also ask about your alerts in the chat. Copilot uses the extension’s tools like any other tool, according to your permission settings.
One limitation worth being clear about from the start: the extension shows only code scanning alerts. Dependabot and secret scanning alerts don’t appear in the canvas.
It works on GitHub.com and GitHub Enterprise Cloud with data residency. GitHub Enterprise Server is not supported.
What is code scanning and what does CodeQL have to do with it?
Code scanning is GitHub’s feature that analyzes a repository’s code and generates alerts when it finds a security issue. Those alerts can come from CodeQL, GitHub’s own analysis engine, or from third-party tools that publish their results to code scanning.
The extension doesn’t scan anything by itself: it works on alerts that code scanning has already generated in your repository. That’s why the alerts section is only available where code scanning is enabled. The exception is /security-review, which reviews your local changes without depending on code scanning (we’ll see that below).
Does it work with free GitHub Copilot? What each plan needs
Yes, partly. GitHub says that any Copilot plan can install the extension and run /security-review on local changes, without code scanning and without a GitHub Code Security license. Working with existing alerts depends on how the repository is configured. At the time this note was published, the requirements were:
| What you want to do | What you need |
|---|---|
Install the extension and run /security-review on local changes |
Any Copilot plan. You don’t need code scanning or a GitHub Code Security license |
| View, fix, and dismiss existing alerts | Code scanning enabled on the repository and permission to view its alerts |
| Same thing on a private repository | GitHub Code Security |
| Use it with Copilot Business or Enterprise | An admin must enable the GitHub Copilot app policy |
| Install plugins where the company restricts them | Permission to install github-security according to your company’s managed settings |
| Dismiss alerts | Permission to dismiss code scanning alerts on the repository |
In short: any developer with Copilot gets pre-pull request review from day one. The alert triage half requires code scanning to already be working on the repository. Keep in mind that even if your plan allows it, AI actions consume AI Credits (see below).
How do you install github-security?
From a terminal:
copilot plugin install github-security@awesome-copilot
Or from the app: in the sidebar, click Customize, search for github-security, and under Plugins, click + Install next to “github-security”.
The plugin and extension are automatically activated after you install them.
How do you view code scanning alerts in the Copilot app?
You see them from the Security canvas of a repository session:
- Start a new session for the repository.
- If the Security canvas isn’t open, click the canvas icon, hover over Canvas, and click Security.
- On the canvas home page, click Code scanning findings.
- To search or filter, use the control in the top right corner of the canvas.
- Click the title of an alert to see its description, severity, and affected code.
To open the alert on GitHub, hover over its row, click the icon, and then click Open in browser.
How do you fix code scanning alerts with Copilot?
You select the alerts and choose Explain or Fix. For a single alert, click it or hover over it in the list to make the buttons appear. For multiple alerts, check their boxes. Then:
- Explain asks the agent to explain the vulnerabilities.
- Fix asks the agent to modify your code to resolve them.
If you asked for a fix, review the diff and run your project’s relevant tests. You can follow the conversation to adjust the fix.
Two details make this work in a real review flow instead of becoming a risk:
- The fix only changes your local copy. It doesn’t commit, doesn’t push, and doesn’t open a pull request. You commit and push with your usual review process.
- A local fix doesn’t close the alert. That’s code scanning’s decision, when the fix reaches the affected branch and analysis runs again.
If you only want an explanation in the chat without touching any files, GitHub’s documentation recommends including “Do not change any files.” in your prompt.
How do you review your changes with /security-review before the pull request?
It runs on a session with changes in progress, and it’s the part that works on any plan, with or without code scanning:
- Open an active session with changes in progress.
- On the Security canvas home page, click Start review under “Security review”, or type
/security-reviewin the prompt box and pressEnter. - Select the findings and click Explain or Fix.
- After changing the code, run the review again. The canvas tells you when the code changed since the last review.
- To see previous results, click Last review results on the home page.
GitHub is explicit about the scope: it’s a review focused on your changes, not a complete security audit or a replacement for code scanning. Running it also doesn’t activate code scanning on the repository.
If you want an AI security review outside the GitHub ecosystem, the approach is similar to the skill Cloudflare released: How to Audit Your Code’s Security with AI Using the Skill Cloudflare Released.
What happens when you dismiss an alert?
Unlike a fix, dismissing an alert does update it on GitHub.
- Click the dismiss icon at the top of the alert’s details page, or hover over its row in the list and click the same icon.
- Click Dismiss.
- Select a reason and add a comment.
- Click Dismiss finding, or Submit request if approval is required.
If your organization uses delegated alert dismissal, the alert stays open until an authorized reviewer approves the request, and that approval happens on GitHub.
How many AI Credits does it consume?
It consumes AI Credits only on AI actions. Explain, Fix, and starting a security review use the model you have selected in the app and consume AI Credits like any other prompt. Viewing alerts and dismissing them don’t use AI.
GitHub doesn’t publish a figure per action, so the cost depends on your selected model and how much code the review covers. If you’re already managing spending, the same limits apply as for the rest of Copilot: GitHub Copilot AI Credits: How to Cap Your Agents’ Spending Before the Bill Arrives.
Security extension or Copilot Autofix?
It depends on where you want to fix: the extension works on your local copy before the pull request, and Copilot Autofix works on GitHub and opens a pull request. Both use Copilot to fix code scanning alerts, but they produce different things.
There are two Autofixes. The classic one suggests fixes in pull requests, doesn’t require a Copilot subscription, and is available on public repositories and private repositories with GitHub Code Security. The agentic one, which reached general availability on October 15, 2026, goes further: you assign the alert to Copilot and it opens the pull request. The table compares the extension with this latter one.
| Security extension (Copilot app) | Agentic autofix (github.com) | |
|---|---|---|
| Status | Public preview | General availability |
| Where it works | In your Copilot app session, on your local copy | On GitHub, when you assign an alert to Copilot |
| What it produces | Changes to your local copy: no commit, no push, no PR | A draft pull request with a fix summary and validation steps |
| Validation | You review the diff and run your tests | Copilot re-runs CodeQL and iterates before opening the PR |
| What alerts | Existing alerts plus /security-review findings on uncommitted changes |
Alerts on the default branch; up to 25 at a time in a single PR |
| Requirements | Any Copilot plan for /security-review; code scanning (and Code Security on private repos) for alerts |
GitHub Code Security or Advanced Security on Enterprise Cloud, a company policy, and a Copilot billing method |
| Billing | AI Credits, like any prompt | AI Credits from your Code Security budget, plus GitHub Actions minutes |
The short version: Autofix is for cleaning up an alert backlog on the default branch via pull requests. The extension is for the developer who wants to understand and fix issues in their own working copy before anything leaves their machine.
What hasn’t GitHub documented yet?
At the time this note was published, GitHub hadn’t published:
- A general availability date.
- A list of supported languages or alert types beyond “code scanning alerts”.
- The AI Credits cost per Explain, Fix, or
/security-reviewaction.
The documentation also doesn’t detail what dismiss reasons are available.
What about you? When a code scanning alert shows up on your team, who fixes it: the person who wrote the change or whoever handles security?
- Before the PR, in my local copy
- In the PR, with suggested fixes
- In a separate backlog, by priority
- I prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your reply gets published here.
Related: How to Audit Your Code’s Security with AI Using the Skill Cloudflare Released