copilot-autofix

How exposed is your code? Find out in minutes—for free (opens in new tab)

GitHub’s Code Security Risk Assessment offers organizations a free, one-click way to uncover vulnerabilities that manual reviews and limited scanning tools may miss. Using CodeQL, it scans up to 20 active repositories and provides a prioritized view of risks by severity, language, repository, and vulnerability type. The assessment also connects findings to GitHub Code Security and Copilot Autofix, helping teams move from discovery to remediation. ## What the Assessment Reveals - Scans up to 20 of an organization’s most active repositories. - Reports vulnerabilities by severity: - Critical - High - Medium - Low - Breaks findings down by programming language. - Identifies the specific security rules and vulnerability classes detected. - Highlights the repositories with the greatest number of vulnerabilities. - Shows which findings are eligible for Copilot Autofix. - Uses CodeQL, GitHub’s static analysis engine. The assessment is free for organization administrators and security managers using GitHub Enterprise Cloud or GitHub Team. Scanning does not consume the organization’s GitHub Actions minutes quota. ## Combining Code and Secret Exposure The Code Security Risk Assessment complements GitHub’s existing Secret Risk Assessment. - Both assessments can be launched from one entry point. - A tabbed interface separates secret exposure findings from code vulnerabilities. - The combined view helps organizations understand their overall security posture. - Secret Protection focuses on preventing credential leaks. - Code Security identifies and helps remediate vulnerabilities in source code. GitHub cites 2025 usage figures for Secret Protection, including nearly 2 billion scanned pushes and 19 million blocked secret exposures. ## From Detection to Remediation Finding vulnerabilities is only the first step; reducing risk requires fixing them. - GitHub reports that Copilot Autofix resolved 460,258 security alerts in 2025. - Half of vulnerability alerts were fixed directly in pull requests. - Mean remediation time was 0.66 hours with Copilot Autofix, compared with 1.29 hours for manual fixes. - Assessment results show how many discovered vulnerabilities could potentially be fixed automatically. - Organizations can enable GitHub Code Security directly from the results page. The assessment is intended for organizations with no current scanning, teams evaluating existing tools, or security leaders seeking broader visibility across repositories. Running it provides a quick, no-cost baseline for prioritizing security work.

GitHub expands application security coverage with AI‑powered detections (opens in new tab)

GitHub is expanding application security coverage with AI-powered detections that complement CodeQL’s traditional static analysis. The approach targets languages and frameworks that are difficult to support through semantic analysis alone, including Bash, Dockerfiles, Terraform, and PHP. Planned for public preview in early Q2, the system brings detection, automated remediation, and enforcement directly into pull requests. ## Hybrid Static Analysis and AI Detection - CodeQL remains the primary tool for deep analysis of supported languages. - AI-powered detections extend coverage to scripts, infrastructure definitions, and less-supported ecosystems. - The system can identify vulnerabilities and suggest fixes within the pull request workflow. - Internal testing analyzed more than 170,000 findings in 30 days, receiving positive feedback from over 80% of developers. - Early supported areas include: - Shell/Bash - Dockerfiles - Terraform/HCL - PHP - The capability is part of GitHub’s broader agentic detection platform, which also supports code quality and code review. ## Security Findings in Pull Requests - GitHub automatically analyzes changes when a pull request is opened. - It selects CodeQL or AI-powered detection based on the code being reviewed. - Findings appear alongside existing code-scanning results, without requiring developers to switch tools. - Example risks include: - Unsafe string-built SQL queries or commands - Weak cryptographic algorithms - Infrastructure configurations exposing sensitive resources - Detecting issues during review allows teams to address vulnerabilities before code is merged or deployed. ## Copilot Autofix for Remediation - GitHub connects detection with Copilot Autofix, which proposes fixes developers can review, test, and apply. - Autofix resolved more than 460,000 security alerts in 2025. - Alerts were resolved in an average of 0.66 hours with Autofix, compared with 1.29 hours without it. - This reduces the gap between discovering a vulnerability and correcting it. ## Security Enforcement at Merge - GitHub positions pull requests as the point where security policies can be enforced. - Detection, remediation, and governance operate within the same workflow. - Teams can reduce risk without adding separate post-deployment review steps. - GitHub plans to demonstrate the technology at RSAC, highlighting hybrid detection and developer-native remediation. GitHub’s recommendation is effectively to combine CodeQL’s precision with AI-based coverage for modern, diverse repositories, while using Copilot Autofix and merge policies to turn findings into timely, enforceable fixes.