Live
Native PyTorch TPU Support Arrives via Open‑Source TorchTPUML Drift simplifies on-device GPU inference across heterogeneous hardwareRethinking Kubernetes for AI Agents: Sandbox Isolation and Warm‑Pool ExecutionCloudflare WAF adds default‑log rules for Brotli encoding and Next.js image endpointGPU Capacity Planning: Validate Outcomes Before Adding HardwareEmbedding Vercel’s Zig Coding Agent: Architecture and Ops ImpactGemini 4 Argon trims ADK session prep and import latency by up to 40%Rethinking CI/CD: The Sensor Limits of an Agentic Software FactoryNative PyTorch TPU Support Arrives via Open‑Source TorchTPUML Drift simplifies on-device GPU inference across heterogeneous hardwareRethinking Kubernetes for AI Agents: Sandbox Isolation and Warm‑Pool ExecutionCloudflare WAF adds default‑log rules for Brotli encoding and Next.js image endpointGPU Capacity Planning: Validate Outcomes Before Adding HardwareEmbedding Vercel’s Zig Coding Agent: Architecture and Ops ImpactGemini 4 Argon trims ADK session prep and import latency by up to 40%Rethinking CI/CD: The Sensor Limits of an Agentic Software Factory
GitHub

Programmatic Control of GitHub AI Scan via New REST API

Ninja·September 11, 2026·2 min read·via GitHub Changelog
AI SummaryPowered by AI

GitHub has added public‑preview REST endpoints that let organizations and repositories enable or disable AI Scan for pull‑request code scanning programmatically. This gives engineers a way to automate security detection rollout across many repos without manual UI steps, but it also introduces new configuration and dependency considerations.

GitHub now exposes public‑preview REST endpoints that let you read and toggle the AI Scan feature for pull‑request code scanning at both the organization and repository levels. Engineers can automate the rollout of AI‑powered security detections across many repositories, eliminating the need to click through the UI for each repo.

AI Scan API Endpoints

The preview introduces two paths:

  • /orgs/{org}/code-scanning/ai-scan – reads or updates the organization‑wide enablement flag.
  • /repos/{owner}/{repo}/code-scanning/ai-scan – reads or updates the per‑repository flag.

Organization settings act as a master switch; if AI Scan is disabled at the org level, repository settings cannot re‑enable it. The endpoints are available to GitHub Advanced Security customers on github.com and are not supported on GitHub Enterprise Server.

Operational Impact

With these APIs you can embed AI Scan configuration into existing automation pipelines, such as Terraform, GitHub Actions, or custom provisioning scripts. This makes it feasible to enforce a security baseline when new repositories are created or when onboarding teams. Because the feature is still in public preview, you should treat the API surface as subject to change and test any automation against a non‑production org before scaling.

Security and Governance Considerations

Enabling AI Scan programmatically adds a new configuration state that must be tracked in your change‑management process. Since the feature requires an Advanced Security subscription, ensure that the target organization has the appropriate license; otherwise API calls will fail. The preview does not extend to GitHub Enterprise Server, so hybrid environments need separate handling for on‑prem instances. Auditing should include both the organization‑level flag and any repository‑level overrides to verify that no repo unintentionally remains unprotected.

Related CloudNinjas coverage: security.

What This Means For Practitioners

  • Integrate the /orgs/.../ai-scan call into your repo‑creation workflow to guarantee AI Scan is on by default.
  • Maintain a source‑of‑truth (e.g., IaC) for the organization‑wide setting to avoid drift between UI and API.
  • Validate that your Advanced Security licensing covers all target orgs before deploying automation.
  • Plan for a migration path when the preview graduates to GA, monitoring for endpoint deprecations or required parameter changes.
Tags: #github#api#security#devops#ai-scan
Originally published atGitHub Changelog
Related Articles
Cloudflare

Cloudflare WAF adds default‑log rules for Brotli encoding and Next.js image endpoint

3 min read
GCP

Data Agent Kit GA introduces open‑source skills and split guardrails for agent‑driven data access

2 min read

TLS certificate authority eMudhra exits market after weak intermediate keys expose supply risk

3 min read