AI moves into GitHub Advanced Security
GitHub Advanced Security has added more than 70 features over the past year aimed at application security testing and software supply chain protection. Capabilities now include grouped Dependabot version updates, variant analysis across up to 1,000 repositories, validity checks for secret scanning, and free secret scanning alerts for public repositories. The new previews extend that work with AI-assisted remediation, secret detection, and custom pattern authoring, plus an upgraded security overview dashboard.
Autofix for code scanning alerts
CodeQL-powered code scanning now offers autofix suggestions for JavaScript and TypeScript alerts directly in pull requests. After the analysis completes, GitHub queries an LLM for fixes to new alerts and posts the AI-generated remediation as code suggestions on both the “Conversation” and “Files Changed” tabs. Developers can review, edit, or immediately commit the suggested changes.
The workflow is intended to reduce fix times by presenting precise, actionable remediation advice at the point where the alert surfaces, avoiding the back-and-forth of a separate security review cycle.
Secret scanning adds AI password detection
Passwords remain a hard problem for secret detection: they are frequently leaked, highly targeted by attackers, and don't follow the fixed patterns typical of API keys. In a limited public beta, secret scanning now applies LLM-based analysis to identify generic or unstructured secrets in code.
Findings appear in a separate “Other” tab alongside low-confidence patterns, letting security managers and repository owners review possibly active leaked passwords without burying higher-confidence alerts. When an alert looks legitimate, the team can route it to the responsible developer for remediation.
Generating custom regex patterns
The secret scanning partner program supports over 225 patterns across 180 partners, but organizations often have internal secret types that require custom detection rules. Writing regular expressions for those cases is close to learning a mini programming language, with many parameters and edge cases to manage.
A new form-based, AI-powered experience walks users through a few simple questions to auto-generate custom patterns as regular expressions. The interface also supports real-time dry runs so patterns can be tested for proper scanning before being saved.
Security overview gains historical dashboard
Security teams get a new view into their organization's alert posture with a security overview dashboard that tracks trends over time. The dashboard organizes data across three lenses:
- Risk. Shows security findings across repositories, including increases or decreases in findings and the categories involved.
- Remediation. Tracks remediation effectiveness, such as how many findings were closed and mean time to remediation.
- Prevention. Surfaces where issues were blocked before reaching code, for example through push protection.
Dashboard tiles respond dynamically to filters for date range, repository, and other criteria, so security managers can drill into AppSec questions without exporting and re-aggregating data.
Together, the new capabilities aim to shift security work into the developer workflow, with AI reducing alert noise and speeding remediation while the dashboard gives security teams the trend data they need to manage the program.
