GitHub Copilot Security Extension: Setup and Limits

On October 28, 2026, GitHub launched a public-preview security extension for the GitHub Copilot app. It places existing code scanning alerts and a focused review of local edits inside a Security canvas beside your coding session. This can reduce the time spent switching between an alert, its affected code and a proposed fix. But the extension is not an automatic repository-wide scanner or an autonomous deployment tool. Eligibility, repository permissions and AI-credit use matter before teams adopt it.

What the security extension does

For a repository with code scanning enabled, the Security canvas shows open findings ordered by severity. You can search or filter, inspect affected code, check linked pull requests, and ask Copilot to Explain or Fix selected alerts. Separately, /security-review checks in-progress local changes before a pull request. Its local findings are not the same as the repository's code scanning alerts. The canvas does not include Dependabot or secret scanning alerts, so those existing security workflows still need attention.

Who can use it and how to install

Any Copilot plan can install the plugin and run local /security-review in the Copilot app. For that local review, GitHub says you do not need GitHub Code Security or enabled code scanning. Existing-alert access has stricter requirements: the repository must have code scanning enabled, you need permission to see its alerts, and private repositories require GitHub Code Security. Copilot Business and Enterprise administrators must allow the Copilot app; managed plugin policies can also restrict installation. GitHub.com and Enterprise Cloud with data residency are supported, but GitHub Enterprise Server is not.

1. Open the GitHub Copilot app and sign in with a Copilot plan; check enterprise policies if managed.
2. Install the plugin using `copilot plugin install github-security@awesome-copilot`, or find `github-security` under Customize and select Install.
3. Start a session for your repository and open its Security canvas.
4. Open Code scanning findings to inspect existing alerts, or run `/security-review` to inspect local edits.
5. Ask Explain or Fix where useful; review any diff, test the change and use your normal pull-request process.

What happens after Copilot suggests a fix?

The Fix action changes only your local working copy. It does not commit code, push changes or create a pull request. A developer must inspect the diff, run relevant tests and move the approved change through the team's usual process. A local patch does not automatically close a GitHub code scanning alert: after the fix reaches the affected branch, code scanning must run again to evaluate whether the issue is resolved. Dismissal is a different action that updates the alert on GitHub, or requests approval where delegated dismissal is configured.

AI credits, permissions and preview limits

Explain, Fix and /security-review use the selected Copilot model and consume AI credits like other prompts. Simply browsing findings or dismissing an alert does not invoke AI. GitHub's announcement and current documentation do not provide a universal fixed price per alert, so use actual account usage and budget controls rather than assumed costs. The extension's tools respect the app's permission settings and can request approval. The feature is in public preview and may change; it does not guarantee comprehensive vulnerability detection.

For teams comparing GitHub's October security announcements, keep the scopes separate: the Copilot security extension is a developer-facing alert and local-review interface, while AI Scan for repositories and AI applications scanning are separate detection capabilities. The extension's strongest use case is a human-in-the-loop workflow from a known finding to a testable local patch. Verify organization policies before a wider rollout.