GitHub announced a public-preview security extension for its Copilot app. Developers with access to code scanning can browse open alerts, filter by severity, and ask Copilot to explain or help fix a finding.
Review stays with the developer
- The extension presents alert details and affected code alongside the local working copy.
- GitHub says suggested fixes are made locally and are not committed or pushed automatically.
- Existing repository alerts require code scanning to be enabled and the user to have permission to see them.
The extension can reduce context switching, but generated fixes still need normal review and tests. Availability and organization policies vary, particularly for private repositories.
Treat it as another interface for security findings, not as a substitute for maintaining code scanning, reviewing alerts, and validating the resulting patch.