Felix Laurent
GitHub has added a security extension to the GitHub Copilot app. It lets developers see their repository's code scanning alerts and ask Copilot to explain, fix or dismiss them without leaving the app. GitHub announced the extension on X on November 15, 2026, and it is now in public preview.
The extension also adds a local security review that checks code changes for vulnerabilities before they reach a pull request. Explaining and fixing alerts uses Copilot's AI credits, while browsing and dismissing them does not.
What the GitHub security extension does
The extension adds a canvas labeled Security next to a Copilot session. Its code scanning view lists a repository's open alerts, sorted by severity, with filters and search. Clicking an alert opens its description, severity and the affected lines of code.
Each alert has two buttons. Explain asks the Copilot agent to describe the vulnerability before anyone decides what to do. Fix asks the agent to change the code to address it. Developers can select several alerts at once and send them to Copilot together.
The canvas also shows linked pull requests, so a developer can see whether someone is already fixing an alert. GitHub's docs suggest asking Copilot directly in chat too, for example to explain the highest-severity open alert without changing any files. The extension's tools follow the app's permission settings, so Copilot asks before using them when approval is required. The fix button works differently from what its name suggests.
How fixes and dismissals work
Fix changes only the local working copy. Copilot does not commit, push or open a pull request. The developer reviews the diff, runs tests and ships the change through the usual review process.
A local fix also does not close the alert on GitHub. The alert closes only after the fix reaches the affected branch and code scanning runs again. That keeps the scanner as the final judge of whether a vulnerability is gone.
Dismissing works the other way. It updates the alert on GitHub right away, so it needs permission to dismiss alerts in the repository. The developer picks a reason, such as a false positive, and adds a comment. If the repository requires approval for dismissals, the extension files a request instead, and the alert stays open until a reviewer approves it on GitHub.
That rule answers a concern raised under GitHub's post. One user asked whether a dismissal leaves a note explaining why, so someone can check it later. It does, since the reason and comment become part of the alert's history. The extension also checks code before any alert exists.
Local security review before a pull request
From the Security canvas, developers can run a security review of the session's current changes. It also starts with the /security-review slash command. Copilot lists findings in the canvas, and each one can be explained or fixed with the same buttons.
The canvas marks when the code has changed since the last review, and earlier results stay available. GitHub says this is a focused check of new changes, not a full security audit or a replacement for code scanning. Local findings stay separate from code scanning alerts on GitHub.
Who can use the security extension
The extension ships as the github-security plugin. Developers can install it from the Customize section of the Copilot app or with one command in Copilot CLI:
copilot plugin install github-security@awesome-copilotTo use it, developers need:
- A Copilot plan and the GitHub Copilot app, signed in to GitHub
- Code scanning enabled on the repository to see existing alerts, with GitHub Code Security for private repositories
- Admin approval on Copilot Business and Enterprise, where the app policy must be turned on
The local review works without code scanning or a Code Security license. The extension supports GitHub.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server. It shows only code scanning alerts, not Dependabot or secret scanning alerts. The extension builds on the app GitHub has been expanding all year.
Where the Copilot app is heading
GitHub first showed the Copilot app at Microsoft Build in May 2026 and opened it to every Copilot plan in July. At its Universe conference on October 28, it added Projects, shared Automations and Copilot Fusion, which picks a model for each task. The security extension is one of the first add-ons shipped after Universe.
It also continues GitHub's earlier work on AI security fixes. Copilot Autofix for CodeQL alerts became generally available in August 2024 and proposes fixes inside pull requests. The new extension moves the same idea into the developer's own agent session, before code is pushed.
Should developers try the GitHub security extension
For teams already using code scanning, the extension removes the trip between the alerts page and the editor. Seeing alerts next to the agent that can fix them, with the scanner still deciding when an alert closes, is a sensible setup. The local review is the bigger gain for smaller teams, since it needs no Code Security license.
The usual caution applies. Copilot's fixes still need human review, and the dismiss button is easy to overuse. Because every dismissal requires a reason and can require approval, teams can keep it in check. GitHub's security extension is worth turning on for any team that already lives in the Copilot app.
Sources
- Security extension announcement, GitHub on X – November 15, 2026
- Viewing and fixing security alerts in the GitHub Copilot app, GitHub Docs
- GitHub Universe 2026: Evolving every layer of the stack, GitHub – October 28, 2026
- GitHub opens Copilot app to every plan, Let's Data Science – July 2026
- GitHub bets on multi-agent software development with Copilot overhaul, InfoWorld
