AI is reshaping how developers approach code security
In a 2023 GitHub survey, developers reported that finding and fixing security vulnerabilities (31%) was their top task after writing code (32%). As organizations shift security checks earlier in the software development lifecycle (SDLC), developers are increasingly the first line of defense against vulnerabilities.
Yet developers remain frustrated with security workflows. Microsoft's One Engineering System team found in late 2019 that developers often must use security tools not designed for them, and they are expected to review, understand, and remediate vulnerabilities on top of their primary coding duties. Security reviews frequently require leaving the IDE to view alerts, research vulnerability types online, and then return to fix code—a context-switching burden that raises cognitive load and lowers productivity.
The security bottleneck isn't just developer-side
The ratio of security experts to developers is starkly imbalanced. Industry reports commonly cite one security expert per 100 developers, and the ISC2 2023 workforce study points to a demand for four million more security professionals. These experts are responsible for setting and enforcing security policies while serving as the last line of defense.
"AI can help with those code and security reviews to ensure that increased momentum doesn't lead to increased vulnerabilities," says Tiferet Gazit, AI lead for GitHub Advanced Security.
The pressure will only intensify. Gartner predicts that 75% of enterprise software engineers will use AI coding assistants by 2028. More code written faster means more code to review and secure.
How AI improves SAST tooling
Better vulnerability detection through automated modeling
Static application security testing (SAST) tools must be shown what to look for. Security experts perform a process called modeling to identify where exploitable user-controlled data enters and flows through a codebase. Because libraries and frameworks change constantly, keeping models current is labor-intensive.
Security teams are now experimenting with AI to model a broader range of open source frameworks and libraries, improving visibility into what each software component contains. This helps SAST tools recognize vulnerabilities they might otherwise miss.
Fixes delivered where developers work
Code scanning autofix combines GitHub's CodeQL SAST engine with GitHub Copilot's generative AI. When a vulnerability is detected, developers receive an AI-suggested code fix alongside the alert directly in a pull request. The suggestion includes an explanation of the vulnerability and why the fix works for their specific case. A GitHub CLI extension enables the same experience from the command line.
The initial release supports JavaScript, TypeScript, Python, Java, C#, and Go. It generates fixes for more than 90% of vulnerability types, and over two-thirds of those fixes can be merged with little or no edits. C++ and Ruby support are planned.
Security integrated throughout the SDLC
With a SAST solution like CodeQL enabled, security checks become part of the CI/CD workflow. When a pull request is created on GitHub, CodeQL conducts a full scan simulating what would happen if the PR were merged, alerting on vulnerabilities in the changed files. This lets developers monitor the security posture of their code as modules come together, before changes land on the main branch.
CodeQL can also run on a schedule via GitHub Actions, enabling regular scans at defined intervals outside of commit and pull request activity.
AI-assisted remediation: how CodeQL autofix narrows the gap between detection and patching
Code scanning autofix, powered by GitHub Copilot builds on CodeQL’s detection capabilities by suggesting a concrete repair alongside the alert. The feature is designed to make SAST results more actionable for developers who may not be security specialists.
“Autofix makes CodeQL friendlier for developers by suggesting a fix and providing contextual explanations of the vulnerability and its remediation,” says Gazit. “This use of AI lowers the barrier of entry for developers who are tasked with fixing vulnerabilities.”
Consider a SQL injection that enters the codebase through a user input field and exploits an unintentional vulnerability, giving an attacker unauthorized access to sensitive data. SAST tools commonly flag this class of flaw. The following walkthrough shows how code scanning autofix detects the injection and present a fix for it.
Detection through multi-stage analysis
Code scanning with CodeQL is free on public repositories and can be scheduled to run without manual triggering. The analysis pipeline consists of four stages centered on the source code: tokenization, abstraction, semantic analysis, and taint analysis.
Tokenization transforms the source into a standardized form ready for analysis. Abstraction builds a hierarchical representation of the code that reflects relationships between lines. Semantic analysis interprets the meaning of that structure. Taint analysis then tracks how user-controlled input moves through the program, identifying data sources, flow steps, sanitizers that neutralize unsafe data, and sinks where unsanitized data could cause harm. CodeQL evaluates whether input sanitization and validation are adequate before deciding whether to raise the path as a potential vulnerability.
Constructing a targeted prompt
For every language CodeQL supports, a SQL injection finding surfaces in a pull request with a natural language description and contextual documentation. The alert also includes a suggested fix that the developer can accept, edit, or dismiss. To generate that enhanced alert, a prompt is assembled for GitHub Copilot containing:
- The initial CodeQL alert and general information about the vulnerability type, typically with an example exploit and remediation pulled from the CodeQL query help.
- Code snippets and line numbers from the files along the data flow identified during taint analysis, marking the locations most likely to need edits.
Machine learning engineers constrain the underlying model in several ways to shape the output:
- The model is limited to editing only the code referenced in the prompt.
- The model is instructed to produce Markdown output with a detailed explanation of the vulnerability and the fix.
- The model is asked to output “before” and “after” code blocks showing the required changes with surrounding context.
- The model must list external dependencies used in the fix, such as data sanitization libraries.
Filtering and refinement checks
Code snippets matching or nearly matching runs of roughly 150 characters of public code hosted on GitHub are filtered from AI-generated suggestions. Vulnerable, off-topic, harmful or offensive content is also removed.
Before the fix is shown to a developer, a separate fix generator processes the LLM output to catch small mistakes. It performs reference checks across output code lines and compares them with the original suggestions. The fix generator then applies several validation steps.
- A fuzzy search checks that “after” code blocks and line numbers match against the unflagged SQL, source-critical “before” lines. The search tolerates minor discrepancies such as indentation, semicolons or comment differences.
- A parser inspects the generated code for syntax errors.
- Semantic checks assess the logic of the proposed fix, using name resolution and type checking to confirm the code maintains the intent of the original.
- Dependency resolution verifies that any libraries suggested by Copilot are present in the project’s configuration file. If a dependency is missing, the fix generator checks that the package exists in the ecosystem’s registry, screens it for known vulnerabilities or malicious behavior, and adds it to the configuration file as part of the fix.
The final alert and developer response
The finished alert appears in the pull request with three parts: an AI-suggested fix, a plain-language explanation of both the vulnerability and the remediation, and a diff patch. The developer can take the proposed edit as is, tailor it, or discard it.
Security as a feature, not a production afterthought
Embedding AI checks into the day-to-day developer workflow shifts security remediation from an end-of-cycle concern into the SDLC itself. Hardening code at the development stage produces a more resilient SDLC, which frees organizations to spend on innovation rather than incident response.
“When you treat security as a feature of the SDLC, your applications become more robust against increasingly complex attacks, which saves you time and money,” notes Hoodlet. “You can direct those saved costs towards other improvements and experimentation with new features. The result? Organizations build a reputation for building secure products while freeing up resources for innovation.”
Security teams in such an environment are also released to focus on work requiring manual expertise.
Looking at measurable outcomes, code scanning autofix generates a patch for more than 90% of vulnerability types CodeQL detects, and over two-thirds of its suggestions can be merged with minimal or no manual changes.
In practice, AI-assisted SAST three gives developers:
- Support for secure coding earlier in development. Issue detection and suggested fixes land in the same pull request context where code is already being reviewed and changed.
- Faster, better vulnerability remediation. The natural language explanations are scoped to the actual detection in a specific codebase rather than a general description, helping developers understand why the flaw exists there and what repair makes sense.
- Security guidance embedded in their workspace. Unlike traditional security tooling, the assistant works where developers already operate, inside the pull request.
For organizations looking to harden their SDLC with AI, the code scanning autofix capabilities of GitHub Advanced Security present a practical entry point. More details on GitHub Copilot’s output filters and data handling policies are available via the GitHub Copilot Trust Center.
