GitHub has made AI Scan for pull requests generally available. The company says it finds vulnerabilities in pull request changes involving languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration, Dockerfiles, JSP for Java and Blazor for C#.
AI Scan runs automatically when code scanning and the repository’s effective AI Scan setting are enabled. Its findings appear alongside CodeQL results in the Conversation and Files changed tabs. An AI indicator identifies them, and a finding can include an explanation of the security risk and a suggested autofix.
The findings are advisory. According to GitHub, they do not fail the code scanning check and cannot block a pull request merge through ruleset requirements. AI Scan also does not run on pull requests from forks or those created by Dependabot.
Read nextREA draws 100,000 GitHub stars as AI reverse engineering gains attentionAI Scan uses Code Security AI Credits
AI Scan uses Code Security AI Credits. GitHub says usage appears under AI usage in enterprise billing and licensing, listed as the Advanced Security product. Customers can set budgets for Code Security AI Credits at the SKU level.
A GitHub Copilot license is not required. AI Scan is now available for public repositories owned by organizations or personal accounts. Private and internal repositories owned by organizations require GitHub Code Security or GitHub Advanced Security.
