GitHub is incorporating AI scanning into its Code Security tool to improve vulnerability detection beyond the capabilities of CodeQL static analysis and support more languages and frameworks.

The developer platform states this change will identify security flaws “in areas that are difficult to address with traditional static analysis alone.”

CodeQL will continue its in-depth analysis for supported languages, while AI will offer wider support for Shell/Bash, Dockerfiles, Terraform, PHP, and other ecosystems.

This new approach is planned to be available for public testing in early Q2 2026, potentially as soon as next month.

GitHub Code Security is a collection of application security tools integrated into GitHub repositories and workflows.

It’s free (with limitations) for all public repositories. However, paid users can access the complete feature set for private/internal repositories via the GitHub Advanced Security (GHAS) add-on package.

It provides code scanning for known vulnerabilities, dependency scanning for vulnerable open-source libraries, secrets scanning to detect leaked credentials, and security alerts with Copilot-driven fix suggestions.

The security tools work at the pull request level, with the platform choosing the right tool (CodeQL or AI) for each scenario, ensuring potential problems are identified before code is merged.

If issues, such as weak encryption, misconfigurations, or unsafe SQL, are found, they are displayed directly in the pull request.

GitHub’s internal tests, which processed over 170,000 findings in 30 days, showed 80% positive developer feedback, indicating the flagged issues were valid.

These results demonstrated “strong coverage” of ecosystems that previously lacked sufficient examination.

GitHub also emphasizes the value of Copilot Autofix, which proposes solutions for issues found by GitHub Code Security.

Data from 2025 involving over 460,000 security alerts handled by Autofix shows that resolution was achieved in an average of 0.66 hours, compared to 1.29 hours without Autofix.

GitHub’s use of AI-driven vulnerability detection signifies a broader trend where security is enhanced by AI and built directly into the development process.