{"slug": "security-extension-for-the-github-copilot-app", "title": "Security extension for the GitHub Copilot app", "summary": "GitHub released a security extension for the GitHub Copilot app in public preview, letting developers browse, explain, fix and dismiss their repository's open code scanning alerts without leaving the app. The extension adds Explain and Fix actions that use the model selected in the app and consume AI credits like any other prompt, plus a /security-review command that surfaces findings on current changes; Copilot only edits the local working copy and does not commit or push. It installs via `copilot plugin install github-security@awesome-copilot` and is available on github.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server, with private repositories requiring GitHub Code Security.", "body_md": "# Security extension for the GitHub Copilot app\n\nYou can now work through your repository’s GitHub code scanning alerts without leaving the GitHub Copilot app. The new GitHub security extension, now in public preview, lets you find the alerts that matter most and ask Copilot to explain or help fix them.\n\nUntil now, fixing a code scanning alert meant switching between the alert on github.com and the code in your editor. With the security extension, you can move from finding an alert to fixing it in one place.\n\n### [Fix the alerts already in your code](#fix-the-alerts-already-in-your-code)\n\nIf you already run code scanning on your repository, the security extension shows its open code scanning alerts:\n\n- Browse every open code scanning alert, ordered by severity, and use search and filters to narrow the list.\n- Open an alert to see its details and the affected code. You can open the full alert page on github.com when you need more context.\n- Select one or more alerts and ask Copilot to **Explain** or**Fix** them. Copilot only makes fixes in your local working copy and doesn’t commit or push anything. This way you can review and iterate on the changes in the app and push when you’re ready.\n- See linked pull requests on an alert so you know whether someone is already working on a fix.\n- Dismiss alerts you don’t plan to fix. If your organization uses delegated alert dismissal, the extension sends your dismissal for approval.\n\n### [Catch new issues before you open a pull request](#catch-new-issues-before-you-open-a-pull-request)\n\n- Run `/security-review` on your current changes and see those findings next to your existing alerts.\n- The extension tells you when your code has changed since the last review so you know when to run it again.\n\nYou can also ask Copilot about your alerts in chat. Copilot uses the security extension’s tools in the same way as any other tool, following your tool permission settings.\n\n### [Get started](#get-started)\n\nTo install the security extension:\n\n- In your terminal run `copilot plugin install github-security@awesome-copilot` .\n- In the GitHub Copilot app, click **Customize** , search for`github-security` , then click**+ Install** .\n\nThe extension is automatically enabled, and you can open the Security canvas from a session for your repository.\n\nThe **Explain**, **Fix**, and `/security-review` actions use the model you’ve selected in the app and consume AI credits in the same way as any other prompt. Browsing and dismissing alerts don’t use AI.\n\nThe security extension is in public preview on github.com and GitHub Enterprise Cloud with data residency. GitHub Enterprise Server isn’t supported.\n\n- **With any Copilot plan:** You can install the extension and run`/security-review` on your local changes. For Copilot Business and Copilot Enterprise, an administrator needs to enable the GitHub Copilot app policy, and can use enterprise managed settings to control which plugins developers can install.\n- **With code scanning:** You can see, fix, and dismiss existing alerts for repositories where code scanning is enabled and you have permission to view the alerts. Private repositories need GitHub Code Security for this.\n\nLearn more in the [security extension documentation](https://docs.github.com/copilot/how-tos/github-copilot-app/view-and-fix-security-alerts?utm_source=app-security-extension-changelog-docs&utm_medium=changelog&utm_campaign=universe-2026) and join the discussion in [GitHub Community](https://github.com/orgs/community/discussions/210997?utm_source=app-security-extension-changelog-community-discussion&utm_medium=changelog&utm_campaign=universe-2026).", "url": "https://wpnews.pro/news/security-extension-for-the-github-copilot-app", "canonical_source": "https://github.blog/changelog/2026-10-28-security-extension-for-the-github-copilot-app", "published_at": "2026-10-28 15:45:00+00:00", "updated_at": "2026-10-28 16:45:33.418662+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents", "ai-products"], "entities": ["GitHub", "GitHub Copilot", "GitHub Copilot app", "GitHub Enterprise Cloud", "GitHub Enterprise Server", "GitHub Code Security"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/security-extension-for-the-github-copilot-app", "markdown": "https://wpnews.pro/news/security-extension-for-the-github-copilot-app.md", "text": "https://wpnews.pro/news/security-extension-for-the-github-copilot-app.txt", "jsonld": "https://wpnews.pro/news/security-extension-for-the-github-copilot-app.jsonld"}}