On 28 October 2026 GitHub released a security extension for the GitHub Copilot app, in public preview. It lists a repository’s open code scanning alerts by severity, and lets a developer ask Copilot to explain or fix one or more of them.
The detail that matters most for buyers: fixes are made only in the developer’s local working copy. Nothing is committed or pushed automatically. A person still reviews the change and decides whether it goes in.
What else it does
- Shows linked pull requests on an alert, so you can see whether someone is already working on it.
- Lets developers dismiss alerts they do not plan to fix. If an organisation uses delegated dismissal, the request goes to an approver.
- Runs
/security-reviewon current changes, with findings shown alongside existing alerts.
Browsing and dismissing alerts uses no AI. Explain, Fix and /security-review use the chosen model and consume AI credits. Any Copilot plan can install the extension and run /security-review on local changes. Viewing and fixing existing alerts needs code scanning enabled on the repository, and private repositories also need GitHub Code Security. GitHub Enterprise Server is not supported.
What it means
Security backlogs are usually long, dull and quietly ignored. Putting an AI fixer next to the alert list lowers the effort of clearing them. The local-only design is also the right pattern: AI proposes, a human approves.
So what
If your product has an unread pile of security alerts, that is a question for your supplier. Ask how many are open, how many are dismissed and why. Our custom software development and AI-assisted development work includes keeping that list short. To review yours, start a project.