From the source
GitHub's new security extension lets developers work through repository code scanning alerts inside the GitHub Copilot app, without switching to github.com or their editor.
- The extension is in public preview and shows open code scanning alerts ordered by severity, with search and filters to narrow the list.
- Opening an alert reveals its details and the affected code, and users can also open the full alert page on github.com when they need more context.
- Copilot's Explain and Fix actions run on selected alerts, but it only changes the local working copy, so nothing is committed or pushed until the developer decides to push.
- Running /security-review covers current changes, and the extension notes when code has changed since the last review, prompting another run.
- Explain, Fix and /security-review use the model selected in the app and consume AI credits like any other prompt, while browsing and dismissing alerts do not use AI.
