Security extension for the GitHub Copilot app is in preview
The new GitHub security extension for the GitHub Copilot app lets you browse code scanning alerts, ask Copilot to explain or fix them, and run a security review on local changes without leaving the app. It is in public preview. Developers who already rely on code scanning will find it a faster way to handle alerts.
Key points
- Browse code scanning alerts ordered by severity, with search and filters.
- Ask Copilot to Explain or Fix selected alerts; fixes land only in your local working copy.
- Review changes in the app before committing or pushing.
- Run /security-review on local changes to catch new issues before opening a pull request.
- Install with copilot plugin install github-security@awesome-copilot or from Customize in the app.
- Explain, Fix and /security-review consume AI credits; browsing and dismissing do not.
GitHub has added a security extension to the GitHub Copilot app, currently in public preview. It lists the code scanning alerts in your repository ordered by severity, with search and filters, and lets you select one or more alerts to have Copilot explain or fix them. Fixes are written only to your local working copy. Nothing is committed or pushed, so you review the changes in the app before deciding to push.
The extension also runs /security-review on your current changes and shows those findings next to your existing alerts, and it flags when your code has changed since the last review. Linked pull requests, dismissals and delegated approval for organizations are handled in the same place. Explain, Fix and /security-review use the model you picked and consume AI credits; browsing and dismissing alerts do not. It works on github.com and GitHub Enterprise Cloud with data residency, not on GitHub Enterprise Server.
Real-world use
- Working through open injection or XSS alerts in a web app by asking Copilot to explain and fix them locally.
- Running /security-review on local changes before opening a pull request to catch new findings early.
- Checking whether a teammate already has a linked pull request for an alert before starting a duplicate fix.
Why it matters
You no longer need to bounce between github.com and your editor to fix code scanning alerts. Because fixes stay local until you push, you keep control of what reaches the repository.