On 15 October 2026 GitHub made AI Scan for pull requests generally available. It reviews the changes in a pull request for security vulnerabilities, and it is designed to fill the gaps left by CodeQL, GitHub’s established scanner.
What it covers
GitHub lists languages and frameworks CodeQL does not handle well, including PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP and Blazor. Findings appear on the pull request with an “AI” label, and may include a plain explanation of the risk and a suggested fix.
Terraform and Dockerfiles are worth noticing. They describe how your product is deployed and hosted, which is where costly mistakes such as exposed storage or over-broad access tend to live, and where traditional code scanners were thinnest.
The limits GitHub states
- Findings are advisory. They do not fail the code scanning check and cannot block a merge through repository rules.
- It does not run on pull requests from forks or on Dependabot pull requests.
- Private repositories need GitHub Code Security or Advanced Security. A Copilot licence is not required.
- It uses Code Security AI credits, so it is metered, and administrators can set budgets.
Why this matters outside engineering
“We scan for security issues” is a common line in supplier proposals, and it tells you very little. A scanner that warns but cannot stop a release is only as strong as the person who reads the warning. AI scanning widens what gets noticed. It does not decide what gets fixed.
So what
Ask any supplier what happens when a security finding appears on your project: who sees it, how fast it is triaged, and whether a high-severity finding can stop a release. Tooling is the easy part of that answer.
For infrastructure-heavy or regulated builds, see our approach to custom software development, or start a project and we will walk you through how we handle security review.