GitHub Copilot app can now fix your code scanning alerts without leaving it

GitHub, a Microsoft company, has released a security extension for the GitHub Copilot app, now in public preview. It lets developers browse code scanning alerts and ask Copilot to explain or fix them, with changes made only in the local working copy.

Until now, fixing a code scanning alert meant moving between the alert on github.com and the code in an editor. GitHub says the extension keeps both steps in one place, inside the desktop app it presented at its Universe event on October 28.

Alerts ordered by severity, fixes kept local

For repositories that already run code scanning, the extension lists open alerts ordered by severity, with search and filters to narrow the list. Opening an alert shows its details and the affected code, and a link leads to the full alert page on github.com. Users can select one or more alerts and ask Copilot to Explain or Fix them.

GitHub says Copilot only edits the local working copy and does not commit or push anything, so the developer reviews and iterates on the change in the app before pushing. Each alert also shows linked pull requests, which tells a reader whether someone is already working on a fix. Alerts that will not be fixed can be dismissed. Where an organization uses delegated alert dismissal, the dismissal is sent for approval instead of taking effect at once.

A second feature targets code that has not shipped yet. Running /security-review on current changes shows the findings next to existing alerts, and the extension flags when the code has changed since the last review. Users can also ask Copilot about alerts in chat, and Copilot calls the extension’s tools under the same tool permission settings as any other tool.

Who can install it, and what it costs

Installation works two ways: run copilot plugin install github-security@awesome-copilot in a terminal, or open Customize in the Copilot app, search for github-security and click Install. The extension is then enabled automatically, and a Security canvas opens from a session for the repository.

The Explain, Fix and /security-review actions run on the model selected in the app and use AI credits like any other prompt. Browsing and dismissing alerts use no AI. The preview is available on github.com and GitHub Enterprise Cloud with data residency; GitHub Enterprise Server is not supported.

Any Copilot plan can install the extension and run the review on local changes. On Copilot Business and Copilot Enterprise, an administrator must enable the GitHub Copilot app policy, and enterprise managed settings can restrict which plugins developers may install. Working with existing alerts requires code scanning on the repository and permission to view its alerts; private repositories also need GitHub Code Security.

Credits start to matter for security work

The analysis angle here is the numbers: how this feature is paid for. The extension arrives alongside a change in how GitHub bills AI. According to our report on the Enterprise change, Copilot is now included for every licensed GitHub Enterprise user, but AI usage is metered from the first request against an enterprise budget. Copilot Chat, code review and Copilot in the cloud need available budget, and the Enterprise Copilot route carries no monthly AI credits per seat. A team that asks Copilot to fix dozens of alerts will therefore draw on that budget, while triage, browsing and dismissal stay free.

The model choice matters too. The extension uses whichever model is selected in the app, and GitHub’s new Copilot Fusion routing is billed at each model’s standard rate, with a 30% discount on model costs for paid plans for a limited time and no end date stated, as we covered in our Fusion article. How much a typical fix costs in credits is not stated.

The design is also a deliberate limit. Fixes stay local and nothing is pushed automatically, which keeps a human between a model’s suggestion and the repository. That is a narrower promise than an agent that opens pull requests by itself, and it fits the app’s use of existing tool permissions.

What the announcement leaves open

The announcement is a short changelog entry and gives no measurements. It does not say how often Copilot’s suggested fixes resolve an alert, how they are checked against the original finding, or what /security-review covers beyond what code scanning already reports. Those points rest on GitHub’s own description and have not been independently verified.

The extension is also tied to a young product. The GitHub Copilot app, according to GitHub’s Universe release notes, is a desktop app that runs AI agents in the background and returns results such as pull requests for review. Its page for the app does not describe plugin support or plans, so the security extension is currently one of the few documented add-ons. GitHub points to the security extension documentation and to GitHub Community for feedback during the preview.

For teams that already use code scanning, the practical change is fewer context switches. For everyone else, the entry point is the local review of changes, which needs no existing alerts.