Code scanning shows AI security detections on pull requests (github.blog)

GitHub has announced the integration of AI-powered security detections in code scanning, which are now visible directly on pull requests. This enhancement significantly expands vulnerability coverage, allowing developers to identify potential security issues in a wider range of languages and frameworks that were previously unsupported by CodeQL. By surfacing these findings within the pull request interface, developers can address security concerns as part of their standard workflow before merging code, making it easier to maintain code quality and security. These AI security detections operate using GitHub's AI detection engine, running automatically when a pull request is created or updated, and results are generated in real-time without waiting for all analysis sources to complete. The feature requires enablement at the enterprise level and must be set up alongside CodeQL default analysis, ensuring a seamless integration into existing security processes. Currently in public preview for GitHub Advanced Security customers, the feature also necessitates a GitHub Copilot license and consumes AI credits during usage, underscoring the ongoing shift towards AI-driven enhancements in the software development lifecycle.