Security extension for the GitHub Copilot app
By Steven Van ·
The public preview covers code scanning alerts and local reviews on all Copilot plans, but not GitHub Enterprise Server.
Code scanning alerts can now be worked through inside the GitHub Copilot app, using a new GitHub security extension in public preview. The documentation describes it as a way to find, understand and fix alerts without switching between github.com and the editor.
Working through existing alerts
The extension adds a Security canvas to a session. Its Code scanning findings view lists open alerts ordered by severity, with search and filters to narrow the list. Opening an alert shows its description, severity and affected code, plus any linked pull requests, so it is clear whether someone is already working on a fix. The full alert page on github.com is one click away from the alert's row.
Alerts can be selected one at a time or in groups, then sent to Copilot with Explain or Fix. Fix changes only the local working copy. Copilot does not commit, push or open a pull request, so the diff can be reviewed, tested and adjusted in the session before anything is pushed. A local fix does not close an alert: that happens after the change reaches the affected branch and code scanning runs again.
Alerts that do not need fixing, such as false positives, can be dismissed with a reason and a comment. This updates the alert on GitHub. If delegated alert dismissal requires approval for the user's role, the extension submits a dismissal request instead, and the alert stays open until a reviewer approves it on GitHub. The extension shows code scanning alerts only, not Dependabot or secret scanning alerts.
Reviewing changes before a pull request
Running /security-review, or clicking Start review on the Security canvas, asks Copilot to check the session's current changes for vulnerabilities. The findings can be explained or fixed in the same way as alerts, and the canvas indicates when the code has changed since the last review. It is a focused check of the changes, not a full repository audit or a replacement for code scanning. It does not require code scanning or a GitHub Code Security license.
Installing and availability
- In a terminal, run copilot plugin install github-security@awesome-copilot.
- In the app, click Customize, search for github-security, and click + Install under Plugins.
The extension is enabled automatically after installation. The Copilot app is available on all Copilot plans, and Copilot Business and Enterprise need the app policy enabled. Viewing alerts requires access to them and code scanning enabled on the repository; private repositories need GitHub Code Security. The preview supports repositories on GitHub.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server.
Explain, Fix and security reviews use the model selected in the app and consume AI credits like other prompts. Browsing and dismissing alerts do not use AI. The extension's tools follow the app's tool permission settings.
