🚀 New in public preview: AI security detections in pull requests for code scanning

We’re introducing AI-powered security detections in pull requests with GitHub code scanning, helping you catch potential issues before merge in code that may not have native CodeQL coverage today.

What’s new

• Broader coverage across languages and frameworks
  AI-powered detections expand coverage beyond CodeQL’s built-in analysis, helping reduce scanning blind spots.

• Findings directly in pull requests
  Alerts appear natively in PRs so developers can review and address potential issues in their normal workflow before merge.
  AI-generated alerts are clearly labeled with AI so they can be distinguished from CodeQL results.

• Simple to enable once policy allows it
  After enterprise-level allowlisting, AI security detections can be enabled for eligible organizations and repositories that use GitHub Code Security and CodeQL default setup.

How it works

AI security detections are powered by GitHub’s AI detection engine and run automatically when a pull request is opened or updated.

• Results appear as they are returned (you don’t need to wait for all analysis sources to finish).
• Findings are informational and do not block pull request merges.

Requirements

To use this feature:

1. An enterprise owner must allow AI security detections in enterprise policy.
2. The feature must be enabled at the organization level.
3. The repository must have CodeQL default setup enabled.

Note: CodeQL does not perform the AI analysis itself, but the AI detection engine depends on CodeQL default setup.

Availability

AI security detections in PRs are now in public preview on GitHub.com for customers with GitHub Code Security (GitHub Advanced Security).
Eligible organizations/repositories can enable it after enterprise-level allowlisting.

Billing (public preview)

During public preview, AI security detections:

• Require a GitHub Copilot license
• Consume your organization’s AI Credits
• Only draw down AI Credits when detections run

Learn more in the AI Credits billing documentation.

---

📚 Learn more: See GitHub's code scanning documentation.
💬 Feedback: Join the discussion by leaving your thoughts and feedback below

[Vivek09Chahal]

Catching on it 😃