techlist.io
KR EN
github

GitHub expands application security coverage with AI‑powered detections (opens in new tab)

dockerterraformai-securitystatic-analysiscodeqlcode-scanninggithub-code-securitycopilot-autofix

GitHub is expanding application security coverage with AI-powered detections that complement CodeQL’s traditional static analysis. The approach targets languages and frameworks that are difficult to support through semantic analysis alone, including Bash, Dockerfiles, Terraform, and PHP. Planned for public preview in early Q2, the system brings detection, automated remediation, and enforcement directly into pull requests.

Hybrid Static Analysis and AI Detection

  • CodeQL remains the primary tool for deep analysis of supported languages.
  • AI-powered detections extend coverage to scripts, infrastructure definitions, and less-supported ecosystems.
  • The system can identify vulnerabilities and suggest fixes within the pull request workflow.
  • Internal testing analyzed more than 170,000 findings in 30 days, receiving positive feedback from over 80% of developers.
  • Early supported areas include:
    • Shell/Bash
    • Dockerfiles
    • Terraform/HCL
    • PHP
  • The capability is part of GitHub’s broader agentic detection platform, which also supports code quality and code review.

Security Findings in Pull Requests

  • GitHub automatically analyzes changes when a pull request is opened.
  • It selects CodeQL or AI-powered detection based on the code being reviewed.
  • Findings appear alongside existing code-scanning results, without requiring developers to switch tools.
  • Example risks include:
    • Unsafe string-built SQL queries or commands
    • Weak cryptographic algorithms
    • Infrastructure configurations exposing sensitive resources
  • Detecting issues during review allows teams to address vulnerabilities before code is merged or deployed.

Copilot Autofix for Remediation

  • GitHub connects detection with Copilot Autofix, which proposes fixes developers can review, test, and apply.
  • Autofix resolved more than 460,000 security alerts in 2025.
  • Alerts were resolved in an average of 0.66 hours with Autofix, compared with 1.29 hours without it.
  • This reduces the gap between discovering a vulnerability and correcting it.

Security Enforcement at Merge

  • GitHub positions pull requests as the point where security policies can be enforced.
  • Detection, remediation, and governance operate within the same workflow.
  • Teams can reduce risk without adding separate post-deployment review steps.
  • GitHub plans to demonstrate the technology at RSAC, highlighting hybrid detection and developer-native remediation.

GitHub’s recommendation is effectively to combine CodeQL’s precision with AI-based coverage for modern, diverse repositories, while using Copilot Autofix and merge policies to turn findings into timely, enforceable fixes.