GitHub Copilot brings security alerts and local fixes into one app

GitHub’s new security extension lets developers move from a code scanning alert to an explanation or proposed fix without leaving the GitHub Copilot app. Announced on October 28 as a public preview, it keeps those edits in your local working copy—the files on your machine. Copilot does not commit them or push them to the shared repository.

From an alert to the affected code

Code scanning uses automated checks to flag potential security problems in repository code. The extension lists open alerts by severity, with search and filters to narrow the list. Opening an alert shows its details and the affected code, with the full alert page on github.com available for more context.

You can select one or several alerts and ask Copilot to Explain or Fix them, then review and revise the proposed edits before sharing them. Linked pull requests show whether someone is already working on an alert.

You can also dismiss alerts you do not plan to fix. If your organization uses delegated alert dismissal, the extension sends your request for approval.

Review your changes before opening a pull request

Run /security-review on your current changes to see its findings alongside existing alerts. The extension indicates when the code has changed since the last review, so you know when to run it again.

You can ask about alerts in chat, too. Copilot uses the extension’s tools under your configured tool permissions. This local review does not enable repository code scanning or replace the requirements for accessing existing alerts.

Local review and existing alerts have different access requirements

Any Copilot plan can install the extension and run /security-review on local changes. For Copilot Business and Copilot Enterprise, an administrator must enable the GitHub Copilot app policy. Enterprise-managed settings can also control which plugins developers may install.

To view, fix or dismiss existing alerts, the repository must have code scanning enabled, and you need permission to view its alerts. Private repositories additionally require GitHub Code Security.

The public preview supports github.com and GitHub Enterprise Cloud with data residency. GitHub Enterprise Server is not supported.

Install from the terminal or the app

You can install the extension by running this terminal command:

copilot plugin install github-security@awesome-copilot

Alternatively, open Customize in the GitHub Copilot app, search for github-security, then select + Install. Either route automatically enables the extension. You can then open the Security canvas from a session for your repository.

Explain, Fix and /security-review use the model selected in the app and consume AI credits like other prompts. Browsing and dismissing alerts do not use AI.