Developers can now investigate code scanning alerts directly in the GitHub Copilot app. The new security extension, available in public preview, lists open alerts, provides filters, and lets users ask Copilot to explain an issue or prepare a fix.
Fixes stay in the local working copy: the extension does not commit or push them. The /security-review command checks current changes before a pull request and works with any Copilot plan. Explanations, fixes, and reviews consume AI credits; browsing alerts does not.
Existing alerts require enabled code scanning and viewing permissions; private repositories need GitHub Code Security. The preview supports github.com and Enterprise Cloud with data residency, excluding Enterprise Server. Business and Enterprise administrators must enable the Copilot app.
Choose a sign-in method or comment as a guest below.