Closing the language gap in application security
Modern repositories are increasingly polyglot — scripts, infrastructure-as-code, and application components across dozens of ecosystems now sit alongside the core languages that traditional static analysis was built for. GitHub Code Security is responding with AI-powered security detections designed to complement CodeQL in areas where conventional static analysis struggles. The capability is scheduled for public preview in early Q2.
The hybrid model pairs CodeQL's deep semantic analysis with AI-powered detections that extend coverage to additional languages and frameworks. In internal testing over a 30-day period, the system processed more than 170,000 findings and garnered over 80% positive developer feedback. Early results show particular strength for Shell/Bash, Dockerfiles, Terraform configurations (HCL), and PHP.
A detection platform that grows
The new detections run on GitHub's agentic detection platform, the same infrastructure that powers security, code quality, and code review across the developer workflow. That architecture matters: what starts as widened coverage can evolve into more sophisticated detection as the platform learns from new vulnerability patterns and development context. The intent is to layer the precision of static analysis with context that only emerges from real-world usage.
Findings where developers already work
Pull requests are where developers review and approve changes, making them a natural home for security outcomes. When a PR is opened, GitHub Code Security picks the most fitting detection method — CodeQL static analysis or the AI-powered detections — and surfaces results inline alongside existing code scanning findings.
The detections cover issues like unsafe string-built SQL queries or commands, insecure cryptographic algorithms, and infrastructure settings that expose sensitive resources. The goal is straightforward: catch vulnerabilities early without asking developers to step outside the review workflow they already use.
From detection to resolution
Finding risks early only helps if fixes follow quickly. GitHub Code Security pairs the expanded detection with Copilot Autofix, which generates suggested fixes that developers can review and apply during normal code review. The numbers show the impact: Autofix resolved more than 460,000 security alerts in 2025, with a median time-to-resolution of 0.66 hours versus 1.29 hours without it.
Enforcement at the merge point
GitHub occupies the merge point in the development lifecycle, and security teams can use that position to enforce outcomes before code ships rather than after. Combining detection, remediation, and policy controls in the pull request itself allows teams to contain risk without adding friction. GitHub is previewing the expanded AI-powered detections at RSAC, demonstrating how hybrid detection and developer-native fixes fit into the company's broader platform governance approach for modern software security.
