The new GitHub Copilot security extension adds a dedicated Security canvas that lists open code‑scanning alerts for the current repository, ordered by severity and filterable by search criteria. Practitioners can open an alert, view the affected snippet, and ask Copilot to Explain the issue or generate a Fix that is written only to the local working copy. No automatic commit or push occurs, so engineers retain full control over when and how changes are introduced.
How the extension works
When code scanning is enabled and the user has permission to view alerts, the extension displays every open alert in a pane inside the Copilot app. Each entry shows severity, a link to the full GitHub alert page, and any associated pull request. Users can select one or more alerts and invoke the following actions:
- Explain – Copilot provides a natural‑language description of the vulnerability.
- Fix – Copilot generates a patch in the local workspace; the engineer reviews the diff before committing.
/security-review– Runs a fresh scan on the current changes and merges the findings with existing alerts.
Chat interactions can also reference alerts, and the extension respects the tool permission settings already configured for Copilot.
Operational impact
Installation is a two‑step process: run copilot plugin install github-security@awesome-copilot in a terminal, then enable the plugin from the Copilot app’s Customize menu. The extension is automatically enabled for the session, and the Security canvas can be opened from any repository view.
Explain, Fix, and /security-review actions consume AI credits in the same way as other Copilot prompts; browsing and dismissing alerts are free. For organizations on Copilot Business or Enterprise, administrators must enable the GitHub Copilot app policy and can restrict which plugins are installable via enterprise‑managed settings.
Security and compliance considerations
The extension runs in public preview on GitHub.com and GitHub Enterprise Cloud with data residency guarantees, but it is not supported on GitHub Enterprise Server. Dismissal of alerts follows existing delegation rules—if an organization uses delegated dismissal, the extension forwards the request for approval rather than silently removing the alert.
Because generated fixes remain local until manually pushed, the risk of unintended code changes is limited to the review stage. However, engineers should still treat the output as untrusted code and apply standard code‑review practices before merging.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
- Enable the plugin in development environments to collapse the alert‑review loop into a single tool.
- Allocate AI credit budgets for Explain/Fix actions and monitor usage via existing Copilot reporting.
- Update CI/CD policies to require a manual review of any Copilot‑generated patches before they enter the pipeline.
- Verify that your organization’s alert‑dismissal workflow and data‑residency requirements are compatible with the public‑preview extension.
