The Pulse
GitHub Makes AI Scan Available for Pull Request Security
GitHub made AI Scan for pull requests generally available on October 15, adding vulnerability checks for languages and frameworks outside CodeQL’s current coverage. The findings are advisory, and the feature uses Code Security AI Credits.
AI.info Team · Written with AI ·
More languages, but no merge gate
GitHub made AI Scan for pull requests generally available on October 15, widening vulnerability checks beyond the languages and frameworks covered by CodeQL. The launch brings a clear trade-off: the scanner can flag risks and suggest fixes, but its findings cannot fail a code-scanning check or stop a pull request from merging under ruleset requirements. Teams gain another review signal, not an enforcement control.
GitHub positions AI Scan as a complement to CodeQL, not a replacement. The company says it can find vulnerabilities in pull request changes involving PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java and Blazor for C#, among other coverage gaps. That makes the feature relevant to repositories whose code includes technologies CodeQL does not currently cover.
Findings appear beside CodeQL alerts
When code scanning and a repository’s effective AI Scan setting are enabled, scans run automatically on eligible pull requests. Results appear on the Conversation and Files changed tabs alongside CodeQL findings, with an “AI” label to distinguish them. A finding can include an explanation of the security risk and a suggested autofix, giving reviewers information to assess before merging.
The advisory status limits what teams can do with those results. AI Scan findings do not fail code-scanning checks and cannot be used to block a merge through ruleset requirements, according to GitHub. The company also excludes pull requests from forks and pull requests created by Dependabot, so the feature does not scan every proposed change.
Access depends on repository type
Public repositories owned by organizations or personal accounts can use AI Scan. For private and internal repositories owned by organizations, GitHub requires either GitHub Code Security or GitHub Advanced Security. A GitHub Copilot license is not required, a change that separates access to this scanning feature from Copilot licensing.
The announcement does not describe AI Scan as a whole-repository audit. It ties the feature to pull request changes: findings appear in the review workflow, and the exclusions apply to specific pull-request sources. Teams evaluating coverage should therefore treat it as an additional check on eligible proposed changes, not as a substitute for a broader security review.
Usage draws from Code Security AI Credits
AI Scan consumes Code Security AI Credits. GitHub says enterprise billing and licensing displays usage in the “AI usage” section under the “Advanced Security” product, and administrators can set budgets at the SKU level. The launch notice gives no per-scan price, so organizations will need to monitor their own credit usage rather than infer a fixed cost from the availability announcement.
GitHub’s release expands the set of pull-request changes its code-scanning product can examine, while leaving final merge decisions with existing controls and human review. The practical boundary is explicit: AI Scan can surface a risk and recommend a fix, but it cannot block the pull request from merging.