Skip to content
GitHub Launches AI Scan for Pull Requests to Enhance Security

GitHub Launches AI Scan for Pull Requests to Enhance Security

First seen 15 Oct 2026, 18:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 19:34 UTC
  • •AI Scan for pull requests is now generally available on GitHub.
  • •It complements CodeQL by scanning for vulnerabilities in additional languages.
  • •Findings from AI Scan are advisory and do not prevent pull request merges.

GitHub has announced the general availability of AI Scan for pull requests, which uses an AI-based scanning engine to identify security vulnerabilities in code changes for languages not covered by CodeQL, such as PHP and Dockerfiles. This feature runs automatically on pull requests when code scanning is enabled, providing findings alongside CodeQL results. However, AI Scan findings are advisory and do not block pull request merges. The feature is available for public repositories and requires GitHub Code Security or GitHub Advanced Security for private repositories. It does not run on pull requests from forks or those created by Dependabot. A GitHub Copilot license is not necessary for its use.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
AI Scan for pull requests launched
GitHub announced the general availability of AI Scan, enhancing security scanning for pull requests.
Github.Blog

More articles in this cluster (3)

Extracted Entities (4)

1 / 2

Common questions

What languages does AI Scan cover?
AI Scan covers languages not supported by CodeQL, including PHP, Shell/Bash, and Dockerfiles.
Can AI Scan findings block merges?
No, AI Scan findings are advisory and do not block pull request merges.
Is a GitHub Copilot license required for AI Scan?
No, a GitHub Copilot license is not necessary to use AI Scan.