GitHub Copilot Security Extension Preview: Handle Code-Scanning Alerts in the App
Browse, explain, and locally fix existing alerts while reviewing current changes in one security canvas
Key takeaways
GitHub released the Security extension for the GitHub Copilot app in public preview on October 28, 2026. It brings existing code-scanning alerts into one security canvas, where users can filter findings, ask Copilot for an explanation or a local fix, and compare those alerts with findings from a security review of current changes. Copilot changes only the local working copy and does not commit or push automatically. Explain, Fix, and security-review requests consume AI credits, while browsing and dismissing alerts do not. This article provides a low-risk workflow for installing the extension in a test repository, choosing one alert, validating the patch, and preserving human ownership of the final commit.
By ENHE AI · 2026-11-01 · AI-assisted drafting and editorial checks.
Direct answer: It moves alert handling earlier but does not complete security acceptance
GitHub announced the Security extension for the Copilot app in public preview on October 28, 2026. It combines existing code-scanning alerts, findings from /security-review on current changes, and Copilot chat in one workspace. The workflow removes context switching, but people still decide whether a finding is valid, how the patch is tested, and whether it can merge.
Check plan, repository, and permission requirements first
Any Copilot plan can install the extension and run /security-review on local changes. Existing alerts require code scanning to be enabled and the user to have permission to view them. Private repositories need GitHub Code Security for alert browsing, fixes, and dismissals. Business and Enterprise environments may also require an administrator to enable the Copilot app policy.
Entry point, input, and expected result for a low-risk trial
Install from the terminal with copilot plugin install github-security@awesome-copilot, or search for github-security under Customize in the Copilot app. Pick one low- or medium-risk alert, use Explain to capture the rationale, and then use Fix. The expected result is a reviewable change in the local working copy, not an automatic change to the remote branch.
Cost, change boundaries, and failure handling
Copilot changes only the local working copy and does not commit or push automatically. Explain, Fix, and /security-review consume AI credits like ordinary prompts, while browsing or dismissing alerts does not. If the list is empty, check whether code scanning is enabled, whether permissions are sufficient, and whether an administrator policy blocks access before repeating requests.
Frequently asked questions
Will a fix automatically reach the default branch?
No. GitHub says fixes stay in the local working copy. Commit, push, review, and merge remain part of the repository's normal process.
Does dismissing an alert use AI credits?
Browsing and dismissing alerts do not use AI. Explain, Fix, and /security-review do consume AI credits.
Why this matters
The value is not replacing a security team. It is helping developers see existing alerts and risks in current changes earlier while keeping the patch diff inside a familiar local review workflow.
Related tools and reading
These pages support the same task, workflow, or risk boundary.
- Copilot app /security-review safety review
- Agentic Autofix generally available
- October Secret Scanning update
Conclusion
Start in a non-production repository with one low- or medium-risk alert. Preserve the original finding, patch diff, test results, and human conclusion. Move the change into the normal commit and review process only when existing tests pass and the patch does not broaden permissions or data access. The extension's suggestion is not a security certificate.
What this means for everyday users
Copilot changes only the local working copy and does not commit or push automatically. Explain, Fix, and /security-review consume AI credits like ordinary prompts, while browsing or dismissing alerts does not. If the list is empty, check whether code scanning is enabled, whether permissions are sufficient, and whether an administrator policy blocks access before repeating requests.
Related tutorials
[[zh]][[/zh]][[en]]Review a public website[[/en]]
SearchScope SEO/GEO
[[zh]][[/zh]][[en]]Access and usage guide[[/en]]
AI Prompt Management System | 418 Bilingual Prompts for Writing, SEO and AI Creation
High-Frequency AI Prompts for Work, Learning, and Teaching guide
High-Frequency AI Prompts for Work, Learning, and Teaching
Related reading
GitHub Copilot App Adds Security Reviews as Coding Agents Move Risk Checks Earlier
GitHub added a /security-review command to the public preview of the GitHub Copilot App on July 14, 2026. The command checks local or uncommitted changes and prioritizes high-confidence findings with severity, confidence, and remediation guidance. It is available across Copilot plans, but it does not replace CodeQL, Dependabot, secret scanning, or human review. A separate enterprise preview can add AI-powered security detections to pull requests and consumes AI credits. Together with agentic autofix and new CodeQL prompt-injection coverage, the update shows coding assistants moving security checks earlier in the development workflow. Ordinary users should treat the output as a review aid, verify each finding, and keep existing testing and approval controls.
GitHub Agentic Autofix Is Generally Available, but Humans Still Own the Merge
GitHub made Agentic Autofix for code scanning alerts generally available on October 15, 2026. After an eligible alert on the default branch is assigned to Copilot, the agent explores relevant files, proposes a fix, reruns CodeQL, iterates when needed, and opens a draft pull request for review. Teams can select as many as 25 alerts for one pull request, or assign the Copilot agent through the REST API. The feature is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, requires enterprise policy enablement and a Copilot billing method, and consumes both Code Security AI Credits and GitHub Actions minutes. This article provides a review checklist for scope, test evidence, hidden behavior changes, credit budgets, rollback, ownership, and final human approval before merge.
GitHub Secret Scanning Update: Fix business Field Filters Before November 12
GitHub published a group of Secret Scanning improvements on October 20, 2026. The most time-sensitive change arrives on November 12: the business field in affected audit-log events will switch from an enterprise display name to the enterprise slug. Integrations should temporarily accept both formats or use the unchanged numeric business_id. The update also expands public-preview revocation for Base64-encoded GitHub tokens in eligible private and internal repositories, adds exemption-request numbers to dismissal webhooks, and returns HTTP 422 for rejected custom-pattern arguments. This article provides a read-only inventory and test-event plan for AI coding teams so reporting, alerts, and webhook correlation do not silently lose data.
GitHub Copilot Repository Plugin Defaults Are GA: Prevent Permission Drift Across Teams
GitHub made repository plugin defaults and enterprise-managed plugin controls generally available in VS Code, Copilot CLI, and the GitHub Copilot app on October 28, 2026. A maintainer can define a marketplace and default plugins for a trusted repository so contributors avoid repeating setup. Enterprise administrators can require or block plugins and restrict installation to approved marketplaces. Managed settings take precedence over repository and personal choices, and a required plugin cannot be disabled by the user. This article gives teams a rollout checklist for validating publisher identity, plugin contents, MCP connections, credentials, uninstall behavior, repository trust, and the difference between a convenient default and a mandatory enterprise control.
GitHub Copilot Cloud Sessions Are GA: How Cross-Device Work Uses Actions Entitlement
GitHub made its connected Copilot cloud experience and cloud sandboxes generally available on paid Copilot plans on October 28, 2026. A user can start a task on github.com, GitHub Mobile, Copilot CLI, the Copilot app, VS Code, Slack, or Microsoft Teams, then continue the same session elsewhere. The included Actions compute entitlement becomes one shared, dollar-based pool for standard hosted runners, cloud sandboxes, and certain larger runners. Billing for cloud-sandbox usage begins in November 2026, so cross-device convenience can affect the same budget used by builds. This article helps users check repository scope, write access, tool permissions, entitlement consumption, and stop conditions before their first cloud session.
GitHub Agent Merge Can Watch Pull Requests in the Cloud: What to Check Before Auto-Fixes
GitHub integrated Agent Merge directly into pull requests on October 28, 2026. A paid Copilot user can select Watch and fix in the merge box, choose failing Actions workflows, merge conflicts, or both, and let Copilot start a cloud development environment when a selected blocker appears. Agent Merge can also be combined with auto-merge, which raises the importance of branch protection, tests, and patch review. The feature does not prove that a generated fix is correct or that business behavior remains unchanged. This article provides an acceptance checklist for choosing blocker types, reviewing the cloud-generated diff, rerunning required checks, and deciding whether automatic merging is appropriate for a repository.