You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.
What’s changed #
Code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level, if the organization belongs to an enterprise. The same permission hierarchy still applies. There’s no new setup step. If you’ve already enabled GitHub code scanning’s AI Scan for your organization, it now runs more broadly across your eligible repositories, regardless of whether CodeQL default setup is configured.
This change is now in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for this release.
To learn more, see our docs about AI-powered security detections. Join the discussion and leave feedback on GitHub Community.