Why Copilot matters for code security

Most developers haven't had formal security training, and most security teams don't have the resources to review everything. That puts the burden on developers to write secure code from the start. GitHub Copilot can help with that, but it's not a replacement for dedicated security tooling. You still need to review everything Copilot produces and pair it with purpose-built scanners.

One of the simplest ways to use Copilot for security is to have it rewrite insecure code. Say you're writing a SQL INSERT statement that takes user input. That's a classic SQL injection vector, where a malicious command like DROP TABLE could be smuggled through a text field. Instead of trying to fix the code yourself, delete it, write a comment explaining what you need, and let Copilot regenerate it with a safer approach.

/*
insert from cart using a parameterized query:
mail, product_name, user_name, product_id, address, phone, ship_date, price" and get a Copilot suggestion
*/

Copilot will typically suggest a parameterized query. Before accepting, review the suggestion carefully — it's your code, and verification is your responsibility. Once you're satisfied, press Tab to accept.

If you don't want to delete existing code, you can ask Copilot to audit what you already have. Highlight the code in question, open Copilot Chat, and ask something like "are there any vulnerabilities in this function?" To widen the net, select the entire file, or use the @workspace tag in Copilot Chat, which tells Copilot to consider all files in your workspace. A good prompt for this is @workspace what's the attack surface?

Copilot will scan your project and suggest fixes, which might mean changing individual lines or adding security-focused packages. For broader improvements, you can use the slash command /fix, which generates suggestions for overall code quality and efficiency. And don't forget you can follow up with questions like:

  • "What does this vulnerability mean?"
  • "Can you suggest a safer way to do this?"

For more prompt ideas, the Copilot Chat Cookbook has a dedicated section on finding existing vulnerabilities.

Free security tools for open source

Copilot is a generalist. It can't always see your production environment, compiler, or deployment method. Dedicated security tools understand those details, and several of them are free for public repositories. GitHub offers a suite of these directly in the repo settings.

Dependabot

If you work in a public repository, you've probably seen pull requests from dependabot. It checks your dependencies for known vulnerabilities and keeps them up to date.

A pull request from Dependabot.

You can control it from the Settings tab, under Code security in the left-hand menu. There, you'll find options to enable or disable alerts and automatic updates.

Code scanning and CodeQL

Also under Code security is Code scanning, which automatically detects common vulnerabilities like the SQL injection example above. Enabling CodeQL analysis is recommended. Click Set up, choose Default, then click the green Enable CodeQL button. CodeQL runs on commits, pull requests, and periodic scans, and it will notify you when it finds a pattern-based vulnerability.

A screenshot showing the window where you can enable CodeQL analysis.

Copilot Autofix

To automate the response to CodeQL findings, enable Copilot Autofix. It's on the same Code security page, below the Enable CodeQL button. When a problem is discovered, Copilot will generate a fix and open a pull request for you to review. You can accept or reject the suggested solution without manually running Copilot each time.

Secret scanning

At the bottom of the Code security page you'll find secret scanning. It looks for exposed passwords, tokens, and other secrets in your code. With Push protection enabled, GitHub will block new secrets from being committed in the first place.

A screenshot showing how to enable Push protection.

There are more security features in GitHub's documentation, plus a quickstart for securing a repository if you want to explore further.

Key takeaways

You don't need to become a security expert overnight. Start with these three habits:

  1. Ask Copilot to find and fix vulnerabilities. Run /fix in Copilot Chat, or highlight a section of code and ask it to check for issues.
  2. Ask for more details when problems surface. Understanding the fix helps you verify Copilot's work and learn for the future.
  3. Enable Dependabot, code scanning, and secret scanning. These tools will alert you to potential problems, and Copilot can help you resolve them.