GitHub Copilot: Security Reviews in the Copilot App
GitHub CopilotThe GitHub Copilot app now supports a /security-review slash command in public preview, letting developers scan their current code changes for high-confidence security vulnerabilities without leaving the app. The scan targets common high-impact issues like injection flaws, cross-site scripting, insecure data handling, path traversal, and weak cryptography, returning a prioritized, actionable list of findings. It's available to Free, Pro, Business, and Enterprise users.
Sources & Mentions
2 external resources covering this update
On-Demand Vulnerability Scanning, Built Into the Workflow
GitHub has brought its /security-review capability, previously available in Copilot CLI, into the GitHub Copilot app as a public preview feature. Developers working inside the app can now run /security-review against their current workstream changes to catch security issues before code lands, rather than waiting for a separate scanning step later in the pipeline.
What Gets Detected
The scan is tuned to catch a focused set of common, high-impact vulnerability classes: injection flaws, cross-site scripting, insecure data handling, path traversal, and weak cryptography. Rather than surfacing an exhaustive list of every possible issue, findings are scored by severity and confidence, so developers see a prioritized view of what actually needs attention before merging.
Fix and Verify in Place
Findings come with actionable suggestions that developers can apply and then reverify, all without leaving the Copilot app interface. That keeps the loop of "find issue, fix issue, confirm it's fixed" inside the same session rather than requiring a round trip to a separate security tool.
How It Complements Existing Tools
/security-review isn't meant to replace GitHub's existing security surface, code scanning, Dependabot, and secret scanning all remain in place. Instead, it functions as a lightweight, on-demand check developers can run against local changes while actively coding, catching issues earlier than a scheduled or CI-triggered scan would.
Availability
The command is available during public preview to Copilot Free, Pro, Business, and Enterprise users, extending a capability that first shipped experimentally in Copilot CLI in June 2026.