# GitHub — Security extension for the GitHub Copilot app

- Company: GitHub (github.com)
- Announced: 2026-10-28T15:45:00+00:00
- Category: capability-change
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://github.blog/changelog/2026-10-28-security-extension-for-the-github-copilot-app
- Record: https://forck.live/items/28833-security-extension-for-the-github-copilot-app
- Subject: Copilot

GitHub's new security extension lets developers work through repository code scanning alerts inside the GitHub Copilot app, without switching to github.com or their editor. The extension is in public preview and shows open code scanning alerts ordered by severity, with search and filters to narrow the list. Opening an alert reveals its details and the affected code, and users can also open the full alert page on github.com when they need more context. Copilot's Explain and Fix actions run on selected alerts, but it only changes the local working copy, so nothing is committed or pushed until the developer decides to push. Running /security-review covers current changes, and the extension notes when code has changed since the last review, prompting another run. Explain, Fix and /security-review use the model selected in the app and consume AI credits like any other prompt, while browsing and dismissing alerts do not use AI.

## Evidence

Verbatim from https://github.blog/changelog/2026-10-28-security-extension-for-the-github-copilot-app:

> You can now work through your repository’s GitHub code scanning alerts without leaving the GitHub Copilot app. The new GitHub security extension, now in public preview, lets you find the alerts that matter most and ask Copilot to explain or help fix them.
> 
> Until now, fixing a code scanning alert meant switching between the alert on github.com and the code in your editor. With the security extension, you can move from finding an alert to fixing it in one place.
> 
> If you already run code scanning on your repository, the security extension shows its open code scanning alerts:
> 
> Browse every open code scanning alert, ordered by severity, and use search and filters to narrow the list.
> 
> Open an alert to see its details and the affected code. You can open the full alert page on github.com when you need more context.
> 
> Select one or more alerts and ask Copilot to Explain or Fix them. Copilot only makes fixes in your local working copy and doesn’t commit or push anything. This way you can review and iterate on the changes in the app and push when you’re ready.
> 
> See linked pull requests on an alert so you know whether someone is already working on a fix.
> 
> Dismiss alerts you don’t plan to fix.

---

Record: https://forck.live/items/28833-security-extension-for-the-github-copilot-app
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md