Cloudflare reported that since the beginning of 2026, its AI code reviewer has identified almost 230,000 deviations from engineering standards, with nearly 16,000 resulting in approval being withheld.…
GitHub's agentic autofix for code scanning alerts, announced in public preview on 10 July 2026, allows Copilot cloud agents to explore repositories, edit code, run validation, and open draft pull requ…
A developer building an LLM-based vulnerability scanner explains why he deliberately designed it to flag safe code, arguing that deterministic taint tracking with false positives is more trustworthy t…
Trail of Bits released a Claude Code plugin marketplace with 26 security-focused skills for AI-assisted code analysis, including auditors for GitHub Actions, C/C++, Rust, and supply chains, plus tools…
GitHub has made GitHub Code Quality generally available on GitHub Enterprise Cloud and GitHub Team, combining CodeQL analysis with AI-assisted detection of maintainability and reliability issues and u…
OpenAI released the open-source Codex Security CLI on npm on July 29, 2024, without a formal announcement, and it quickly gained 2,600 stars on Hacker News within 24 hours. The tool, which is Apache 2…
GitHub's July 14 changelog announced AI security detections for Shell, Dockerfiles, Terraform, and PHP on pull requests, but access requires a GitHub Code Security (Advanced Security) subscription, a …
A developer created a free GitHub Action that runs ShellCheck, Hadolint, tfsec, and PHPStan on repositories and uploads the results as SARIF to GitHub's Security tab, bypassing the paywall for GitHub'…
A developer proposes an agentic validation and inspection layer built with LangGraph, MCP, and A2A to complement traditional CI/CD pipelines. The architecture combines deterministic tools like SQL lin…
GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team, offering deterministic CodeQL analysis and AI-assisted detection to catch maintainability and reliability iss…
GitHub announced on July 10, 2026 that CodeQL 2.26.0 adds AI prompt-injection detection. A developer provides implementation templates for building a regression fixture to test the query, emphasizing …
GitHub shipped /security-review to its Copilot desktop app on July 14, putting AI-powered pre-commit vulnerability scanning in front of every Copilot user, including those on the free tier, without re…
GitHub has shipped a pre-commit vulnerability scanning feature for Copilot, available to all subscribers including Free tier users. The slash command scans uncommitted diffs for five OWASP vulnerabili…
GitHub shipped agentic autofix in public preview on July 14, 2026, upgrading Copilot Autofix from a one-shot suggestion to a full agent loop that explores the codebase, generates a fix, reruns CodeQL …
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. The feature,…
GitHub shipped CodeQL 2.26.0 on July 10 with a new static analysis query, js/system-prompt-injection, that detects untrusted user input flowing into AI model system prompts in JavaScript and TypeScrip…
GitHub Copilot launched a public preview of /security-review, an AI-driven slash command that scans in-flight diffs for high-confidence security vulnerabilities before code is committed. The feature, …
GitHub shipped CodeQL 2.26.0 on July 10 with a static analysis query that detects prompt injection in AI applications by tracking untrusted user data into system prompts for OpenAI, Anthropic, and Goo…
GitHub released CodeQL 2.26.0, adding support for Kotlin 2.4.0 and a new JavaScript/TypeScript query to detect AI system prompt injection vulnerabilities. The update also improves analysis accuracy ac…
GitHub launched agentic autofix in public preview for code scanning alerts, enabling Copilot to explore codebases, propose fixes, and validate them with CodeQL before opening pull requests. The featur…