Back to rankings

GitHub Copilot App: Security Extension for Code Scanning Alerts (Preview)

GitHub CopilotView original changelog

GitHub released a security extension in public preview for the GitHub Copilot app that lets developers work through code scanning alerts without leaving the app. Copilot can explain or fix selected alerts in the local working copy, and /security-review surfaces new findings on current changes before a pull request. Browsing and dismissing alerts uses no AI credits, while Explain, Fix and /security-review do.

Key Takeaways

  • Code scanning alerts now live inside the Copilot app, sorted by severity with search and filters.
  • Explain and Fix actions let Copilot work on one or many alerts at once.
  • Fixes stay in the local working copy, with no automatic commit or push.
  • /security-review catches new issues before a pull request and shows when code changed since the last review.
  • Browsing and dismissing are free of AI credits, while Explain, Fix and review consume them.
  • Installable with one command or from the app's Customize panel, in public preview for github.com and Enterprise Cloud with data residency.

Handling Alerts Inside the Copilot App

The new GitHub security extension, now in public preview, brings repository code scanning alerts into the GitHub Copilot app. Developers can browse open alerts sorted by severity, with search and filters, open one to see its details and affected code, or jump to the full alert on github.com.

Fixing and Dismissing Alerts

Developers can select one or more alerts and ask Copilot to Explain or Fix them. Copilot only makes fixes in the local working copy and does not commit or push anything. Linked pull requests are shown so developers can see whether someone is already working on a fix. Alerts that will not be fixed can be dismissed, and organizations using delegated alert dismissal route the dismissal to an approver.

Catching Issues Before a Pull Request

Running /security-review on current changes shows its findings alongside existing alerts, and the extension indicates when code has changed since the last review. Developers can also ask Copilot about their alerts in chat, subject to their tool permission settings.

Installation and Cost

Install it with copilot plugin install github-security@awesome-copilot in a terminal, or in the app by clicking Customize, searching for github-security and clicking Install. It is enabled automatically. Explain, Fix and /security-review use the selected model and consume AI credits; browsing and dismissing alerts do not.

Availability

The extension is in public preview on github.com and GitHub Enterprise Cloud with data residency; GitHub Enterprise Server is not supported. Any Copilot plan can install it and run /security-review on local changes. Copilot Business and Enterprise need an administrator to enable the GitHub Copilot app policy. Viewing, fixing and dismissing alerts requires code scanning enabled and permission on the repository, and private repositories need GitHub Code Security.