Security extension for the GitHub Copilot app

Overview

GitHub released a security extension for the GitHub Copilot app in public preview on October 28, 2026. It lists open code scanning alerts by severity with search and filters, lets users ask Copilot to explain or fix selected alerts (fixes land only in the local working copy, with no commits or pushes), shows linked pull requests, and supports dismissal, including delegated dismissal. Running /security-review on current changes shows findings next to existing alerts. Install with copilot plugin install github-security@awesome-copilot or from Customize in the app. Explain, Fix and /security-review consume AI credits; browsing and dismissing do not. It works on github.com and GitHub Enterprise Cloud with data residency, not Enterprise Server.

This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.

Key features

• Code scanning alert triage sorted by severity with search and filters
• Explain and Fix actions that change only the local working copy
• Pre-PR /security-review alongside existing alerts
• Shows linked pull requests and supports delegated dismissal
• Installed as a plugin: copilot plugin install github-security@awesome-copilot

Use cases

• Clearing code scanning backlog from inside the Copilot app
• Checking local changes for security issues before opening a PR
• Enterprise review of which plugins developers may install

Pricing

Public preview. Explain, Fix and /security-review use AI credits; alert browsing and dismissal do not. Existing alerts need code scanning, and private repositories need GitHub Code Security.

Pricing reflects the source record and may change. Confirm current terms with the provider.

Dates and sources

Released

28 Oct 2026

Record updated

2 Nov 2026

Record last checked

2 Nov 2026

• github.blog/changelog/2026-10-28-security-extension-for-the-github-copilot-app