GitHub Copilot Now Scans Your Code Before You Commit — and Fixes Security Alerts Autonomously

GitHub Copilot shipped two security features on July 14: a /security-review command for pre-commit vulnerability scanning (all plans, Free included), and an agentic CodeQL autofix that explores your codebase, remediates the alert, reruns the scanner to confirm, and opens a PR — all autonomously.

Security review in the Copilot desktop app. The /security-review slash command scans in-flight code changes before commit, flagging injection flaws, XSS vectors, insecure data handling, path traversal, and weak cryptography. Findings are scored by severity and confidence. Available now in public preview for Copilot Free, Pro, Business, and Enterprise.

Agentic autofix for code scanning (GHAS + Copilot). For organizations with GitHub Advanced Security and a Copilot license: when CodeQL surfaces an alert, agentic autofix takes over. It explores relevant files across the codebase the way a developer would, proposes a targeted fix, reruns CodeQL to confirm the alert is closed, then opens a pull request for human review. Fix generation takes 2–4 minutes. This requires Copilot cloud agent to be enabled.

Why it matters: Pre-commit scanning catches injection and crypto issues at the cheapest possible fix point — before the code exists in any branch or review queue. The agentic CodeQL autofix closes the longest dead zone in a security program: the gap between "scan found something" and "the issue is actually remediated." Both features bring agentic patterns to security work that previously required dedicated human time.

Sources: Security reviews now available in the GitHub Copilot app — GitHub Changelog · Agentic autofix for code scanning alerts in public preview — GitHub Changelog