code-scanning

How exposed is your code? Find out in minutes—for free (opens in new tab)

GitHub’s Code Security Risk Assessment offers organizations a free, one-click way to uncover vulnerabilities that manual reviews and limited scanning tools may miss. Using CodeQL, it scans up to 20 active repositories and provides a prioritized view of risks by severity, language, repository, and vulnerability type. The assessment also connects findings to GitHub Code Security and Copilot Autofix, helping teams move from discovery to remediation. ## What the Assessment Reveals - Scans up to 20 of an organization’s most active repositories. - Reports vulnerabilities by severity: - Critical - High - Medium - Low - Breaks findings down by programming language. - Identifies the specific security rules and vulnerability classes detected. - Highlights the repositories with the greatest number of vulnerabilities. - Shows which findings are eligible for Copilot Autofix. - Uses CodeQL, GitHub’s static analysis engine. The assessment is free for organization administrators and security managers using GitHub Enterprise Cloud or GitHub Team. Scanning does not consume the organization’s GitHub Actions minutes quota. ## Combining Code and Secret Exposure The Code Security Risk Assessment complements GitHub’s existing Secret Risk Assessment. - Both assessments can be launched from one entry point. - A tabbed interface separates secret exposure findings from code vulnerabilities. - The combined view helps organizations understand their overall security posture. - Secret Protection focuses on preventing credential leaks. - Code Security identifies and helps remediate vulnerabilities in source code. GitHub cites 2025 usage figures for Secret Protection, including nearly 2 billion scanned pushes and 19 million blocked secret exposures. ## From Detection to Remediation Finding vulnerabilities is only the first step; reducing risk requires fixing them. - GitHub reports that Copilot Autofix resolved 460,258 security alerts in 2025. - Half of vulnerability alerts were fixed directly in pull requests. - Mean remediation time was 0.66 hours with Copilot Autofix, compared with 1.29 hours for manual fixes. - Assessment results show how many discovered vulnerabilities could potentially be fixed automatically. - Organizations can enable GitHub Code Security directly from the results page. The assessment is intended for organizations with no current scanning, teams evaluating existing tools, or security leaders seeking broader visibility across repositories. Running it provides a quick, no-cost baseline for prioritizing security work.

GitHub expands application security coverage with AI‑powered detections (opens in new tab)

GitHub is expanding application security coverage with AI-powered detections that complement CodeQL’s traditional static analysis. The approach targets languages and frameworks that are difficult to support through semantic analysis alone, including Bash, Dockerfiles, Terraform, and PHP. Planned for public preview in early Q2, the system brings detection, automated remediation, and enforcement directly into pull requests. ## Hybrid Static Analysis and AI Detection - CodeQL remains the primary tool for deep analysis of supported languages. - AI-powered detections extend coverage to scripts, infrastructure definitions, and less-supported ecosystems. - The system can identify vulnerabilities and suggest fixes within the pull request workflow. - Internal testing analyzed more than 170,000 findings in 30 days, receiving positive feedback from over 80% of developers. - Early supported areas include: - Shell/Bash - Dockerfiles - Terraform/HCL - PHP - The capability is part of GitHub’s broader agentic detection platform, which also supports code quality and code review. ## Security Findings in Pull Requests - GitHub automatically analyzes changes when a pull request is opened. - It selects CodeQL or AI-powered detection based on the code being reviewed. - Findings appear alongside existing code-scanning results, without requiring developers to switch tools. - Example risks include: - Unsafe string-built SQL queries or commands - Weak cryptographic algorithms - Infrastructure configurations exposing sensitive resources - Detecting issues during review allows teams to address vulnerabilities before code is merged or deployed. ## Copilot Autofix for Remediation - GitHub connects detection with Copilot Autofix, which proposes fixes developers can review, test, and apply. - Autofix resolved more than 460,000 security alerts in 2025. - Alerts were resolved in an average of 0.66 hours with Autofix, compared with 1.29 hours without it. - This reduces the gap between discovering a vulnerability and correcting it. ## Security Enforcement at Merge - GitHub positions pull requests as the point where security policies can be enforced. - Detection, remediation, and governance operate within the same workflow. - Teams can reduce risk without adding separate post-deployment review steps. - GitHub plans to demonstrate the technology at RSAC, highlighting hybrid detection and developer-native remediation. GitHub’s recommendation is effectively to combine CodeQL’s precision with AI-based coverage for modern, diverse repositories, while using Copilot Autofix and merge policies to turn findings into timely, enforceable fixes.

Investing in the people shaping open source and securing the future together (opens in new tab)

Open source security depends on supporting the maintainers who sustain critical software, not merely hosting their code. GitHub argues that funding, education, practical security tools, and AI assistance can reduce maintainer burnout while improving the broader software supply chain. Its new commitments focus on making security work more manageable as AI accelerates both vulnerability discovery and attacks. ## A $12.5 Million Open Source Security Commitment - GitHub is joining Anthropic, AWS, Google, and OpenAI in committing $12.5 million to the Linux Foundation’s Alpha-Omega initiative. - The funding will help integrate emerging AI security capabilities into existing open source workflows. - The effort builds on GitHub’s broader role as a provider of security tools, education, and long-term maintainer support. ## Expanding Maintainer Resources - More than 280,000 GitHub maintainers are eligible for free access to: - Core GitHub services - GitHub Copilot Pro - GitHub Actions - Code scanning and Autofix - Secret scanning and push protection - Dependency alerts - GitHub’s Secure Open Source Fund is adding $5.5 million in Azure credits and funding for training, expertise, community support, and new partners such as Datadog, Open WebUI, the Atlantic Council, and OWASP. - GitHub Security Lab is improving security advisories and Private Vulnerability Reporting to reduce low-quality reports and ease the burden on maintainers. ## Results from Security-Focused Funding - Previous Secure Open Source Fund programs supported 138 projects and more than 200 maintainers across 38 countries. - Participating projects produced: - 191 new CVEs - More than 250 prevented secret leaks - More than 600 detected and resolved leaked secrets - These projects collectively affect billions of monthly software downloads. - GitHub concludes that security improves when maintainers receive dedicated time, funding, education, and tools that fit naturally into their workflows. ## Using AI to Reduce Maintainer Burden - AI has increased the speed and scale of vulnerability discovery for both attackers and defenders. - Maintainers are facing more automated pull requests and security reports, often with poor signal-to-noise ratios, contributing to burnout. - GitHub’s goal is to use AI for triage, pull request review, vulnerability identification, and remediation—not simply to generate more findings. - GitHub has open sourced an AI-powered security research framework so maintainers, rather than only specialized security teams, can benefit from it. - Copilot Pro provides eligible maintainers with AI-assisted code review, agentic security remediation workflows, and access to multiple leading models. GitHub’s overall recommendation is to treat AI as a force multiplier and pair it with sustained funding, education, and workflow-integrated security tools. Supporting maintainers directly is presented as the most effective way to protect the wider software ecosystem.

What’s new with GitHub Copilot coding agent (opens in new tab)

GitHub Copilot coding agent is becoming more capable at handling delegated development work from issue to pull request. Recent updates let users choose models, receive self-reviewed and security-checked changes, apply team-specific workflows through custom agents, and move tasks between the cloud and local CLI without losing context. Together, these features aim to reduce cleanup and make background coding tasks more reliable. ## Model selection for different tasks - The Agents panel now includes a model picker. - Users can choose faster models for routine work, stronger models for complex refactoring or integration tests, or let GitHub select automatically. - Model selection is currently available to Copilot Pro and Pro+ users; Business and Enterprise support is planned. ## Self-review before pull requests - Copilot coding agent now runs Copilot code review on its own changes before opening a pull request. - It incorporates feedback and improves the patch, such as simplifying overly complex code. - Users can inspect the review and iteration steps in the task logs before reviewing the resulting pull request. ## Integrated security checks - The agent performs code scanning, secret scanning, and dependency vulnerability checks during its workflow. - Vulnerable dependencies, exposed API keys, and other risky patterns can be identified before a pull request is created. - These code-scanning capabilities are provided without requiring a separate GitHub Advanced Security subscription for this workflow. ## Custom agents for team processes - Teams can define specialized agents in `.github/agents/`. - Custom agents can enforce repeatable procedures, such as benchmarking code before and after a performance change. - Agents can be shared across an organization or enterprise to standardize development practices. - The article describes a custom performance agent that achieved a 99% improvement on a targeted lookup function. ## Cloud and local CLI handoff - Cloud coding-agent sessions can be continued locally with their branch, logs, and context intact. - Users can select “Continue in Copilot CLI” and run the provided command in a terminal. - Pressing `&` in the CLI delegates work back to the cloud without restarting the task. GitHub recommends using these features to match models and workflows to each task, while reviewing the agent’s logs and pull requests. Planned capabilities include private mode, planning before coding, and tasks that produce summaries or reports instead of pull requests.