GitHub Copilot app security extension proposes local fixes without pushing commits
GitHub announced a security extension for the GitHub Copilot app in public preview on October 28. It brings repository code-scanning alerts into the app so developers can inspect findings and ask Copilot to explain or help fix them. The feature is distinct from GitHub's AI-application scanning detector announced the same day.
The extension lists open alerts by severity and supports search and filtering. Developers can inspect alert details and affected code, see linked pull requests and open the full alert on github.com. Seeing an alert in the app does not mean it has been fixed.
GitHub says proposed fixes only change the local working copy. Copilot does not commit or push those changes. Developers can review diffs, test and revise before deciding what to publish. If an organization uses delegated alert dismissal, a dismissal request goes for approval rather than bypassing that process.
The extension also supports a security review of current local changes and notes when code has changed since the last review. Explain, Fix and local security-review actions use the selected model and consume AI credits like other prompts. Browsing and dismissing alerts do not use AI.
Installation and local review are available with any Copilot plan. Copilot Business and Enterprise require the app policy to be enabled by an administrator, and managed settings can restrict plugins. Viewing and handling existing alerts requires code scanning and permission to see them; private repositories also need GitHub Code Security.
The preview supports github.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server. The announcement does not establish that an individual organization has approved the plugin or that generated fixes are correct. Teams should keep license and policy checks, local testing and the decision to commit separate.