Code scanning autofix moves from detection to remediation
GitHub has announced the public beta of code scanning autofix for all GitHub Advanced Security customers. The feature, powered by GitHub Copilot and CodeQL, generates code suggestions for over 90% of alert types in JavaScript, TypeScript, Java, and Python. GitHub reports that the suggestions require little or no editing in more than two-thirds of cases.
The release reflects a broader shift from simply identifying vulnerabilities to actively resolving them. GitHub Advanced Security already reduces remediation time by 7x compared to traditional security tools, according to the company. Autofix aims to cut that effort further by addressing a persistent industry problem: the growing pile of unremediated vulnerabilities in production repositories.
What developers see
When CodeQL detects a supported vulnerability, the alert now includes a natural language explanation of the suggested fix alongside a code preview developers can accept, edit, or dismiss. Suggestions aren't limited to the current file, either—they can include changes across multiple files and recommend dependencies that need to be added to the project.
How the suggestions are generated
Autofix combines the CodeQL engine with heuristics and GitHub Copilot APIs to craft its recommendations. GitHub has published documentation detailing the system architecture, data flow, and limitations of the feature for those who want to understand what's happening behind the scenes.
Roadmap and availability
GitHub plans to add support for C# and Go next. For now, organizations without GitHub Advanced Security or GitHub Enterprise can contact GitHub to request a demo or set up a free trial.
GitHub has also opened a community discussion for feedback on the autofix experience, inviting users to help shape future improvements as the company continues moving toward a model where a vulnerability found is a vulnerability fixed.
