GitHub Copilot app gets a security extension for code scanning alerts, in public preview

GitHub says a new security extension lets users work through a repository's code scanning alerts inside the GitHub Copilot app. Alerts are listed by severity with search and filters; a user can open an alert, see linked pull requests, dismiss it (sent for approval where delegated dismissal is used), or ask Copilot to explain or fix one or several. Fixes are made only in the local working copy; nothing is committed or pushed. The /security-review command checks current local changes and shows findings next to existing alerts.

Install it with copilot plugin install github-security@awesome-copilot or from Customize in the app. Explain, Fix and /security-review use the selected model and consume AI credits; browsing and dismissing do not. It works on github.com and GitHub Enterprise Cloud with data residency, not GitHub Enterprise Server. Seeing existing alerts needs code scanning (GitHub Code Security for private repositories); on Copilot Business and Enterprise an administrator must enable the Copilot app policy.