GitHub is moving code scanning closer to automated repair. Its new code-scanning autofix feature is now in beta for GitHub Advanced Security customers, with a focus on finding and fixing security vulnerabilities during the coding process.
The tool brings together GitHub Copilot and CodeQL, GitHub’s semantic code analysis engine. GitHub says the system can remediate more than two-thirds of the vulnerabilities it finds, often without developers needing to edit the code themselves.
What GitHub Is Launching
The new feature is the first beta of GitHub’s code-scanning autofix capability. It was first previewed last November and is now available to all GitHub Advanced Security customers.
The basic idea is straightforward: code scanning identifies a vulnerability, then the autofix system proposes a repair and an explanation. Instead of leaving developers with only an alert, GitHub is trying to turn more alerts into direct remediation work.
GitHub says the feature will cover more than 90% of alert types in the languages it currently supports. Those languages are JavaScript, Typescript, Java, and Python.
That scope matters because security alerts can create heavy follow-up work for engineering teams. A tool that suggests a fix at the point of discovery can reduce the gap between detecting a problem and resolving it.
How The System Fits Together
CodeQL sits at the center of the feature. GitHub describes CodeQL as its semantic analysis engine, used to find vulnerabilities in code before the code has been executed.
CodeQL has been part of GitHub’s security tooling for years. The company made a first generation of CodeQL available to the public in late 2019, after acquiring the code analysis startup Semmle, where CodeQL was incubated.
In this new autofix system, CodeQL is not working alone. GitHub says the feature also uses “a combination of heuristics and GitHub Copilot APIs” to suggest fixes. For generating the fixes and their explanations, GitHub uses OpenAI’s GPT-4 model.
The result is an AI-assisted workflow aimed at turning vulnerability detection into suggested code changes. The developer still receives a proposed fix, but the system is designed to remove some of the manual work that usually follows a security alert.
Why Developers And Security Teams Care
Security remediation often competes with feature work, maintenance and production issues. GitHub is positioning code scanning autofix as a way to reduce the time development teams spend on common fixes.
In GitHub’s announcement, the company framed the benefit this way: “Just as GitHub Copilot relieves developers of tedious and repetitive tasks, code scanning autofix will help development teams reclaim time formerly spent on remediation.”
The same announcement also says security teams should benefit from “a reduced volume of everyday vulnerabilities,” allowing them to focus on broader strategies to protect the business while development continues at a faster pace.
That is the central promise of the product: fewer routine vulnerabilities waiting in the queue, and more developer time available for work that cannot be automated as easily.
The Limits Of Autofix
GitHub is making strong claims about the feature’s expected usefulness. It says code scanning autofix can remediate more than two-thirds of the vulnerabilities it finds, and that many of those fixes may not require developers to edit code themselves.
At the same time, GitHub is not presenting the system as flawless. The company notes that “a small percentage of suggested fixes will reflect a significant misunderstanding of the codebase or the vulnerability.”
That caveat is important. A suggested security fix still has to be understood in the context of the codebase. Even when an AI tool produces a plausible patch, teams need to review whether the change actually addresses the vulnerability without creating a new issue.
For now, the most practical way to view code scanning autofix is as a remediation assistant. It can speed up the path from alert to fix, but it does not remove the need for engineering judgment.
A Bigger Shift In AI Coding Tools
GitHub’s launch also fits into a broader moment for AI-assisted software work. Earlier the same day, Sentry announced its AI Autofix feature for debugging production code. GitHub’s release applies a similar automation theme to security vulnerabilities found during development.
The shared direction is clear: AI tools are moving beyond code completion and into more direct participation in debugging, analysis and remediation. In GitHub’s case, the feature combines real-time Copilot capabilities with CodeQL’s vulnerability analysis and GPT-4-generated fix explanations.
For GitHub Advanced Security customers, the beta offers an early look at how security workflows may change when detection and repair are more tightly connected. The value will depend not only on how many vulnerabilities the system can address, but also on how well teams review and trust the fixes it proposes.