What changed
GitHub’s October 28 notices announce repository AI Scan and a Copilot app security extension as public previews. They support github.com and Enterprise Cloud with data residency, excluding Enterprise Server. [1][2]
AI Scan runs on demand against the default branch. It chooses code within a time budget; it neither reads every file nor guarantees complete detection. [3]
Who can use each check
Repository scans need no Copilot license. Eligible public repositories qualify; organization private/internal ones need Code Security or Advanced Security. Personal private repositories are unsupported. Applicable policies must permit and enable scanning. [3]
Why the bill and finish matter
AI Scan uses Code Security AI credits, separate from active-committer licenses. Eligible included credits apply first; usage beyond them, or without them, is metered. Managed-user personal namespaces are excluded. [5]
The extension’s Explain, Fix, and local review use the app’s selected model and AI credits. Fix leaves changes local, without committing or pushing. A Copilot plan and plugin permission are required; viewing existing private alerts also needs Code Security and alert access. [4]
A fix is not a closed finding
Merging does not trigger a new repository scan. Rerun it; exact-line fixes may close alerts automatically, while others require manual closure. Local review does not enable server code scanning. We tested none of these features. [3][4]
Our take
For experienced technicians, decide which branch, budget, and completion evidence a check covers before starting. Keep a reviewable patch, test the intended behavior, and compare the result with the original finding. A clean result can inform that decision; it does not replace normal testing or establish that the whole application is secure.