You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A trio of security-focused upgrades is here to help you ship faster and safer: Copilot coding agent now auto‑validates the code it writes, CodeQL adds Rust and build‑free C/C++ scanning to GA, and you can assign code scanning alerts directly to Copilot for automated fixes.
When Copilot coding agent creates new code, it now:
Runs CodeQL to detect vulnerabilities.
Checks newly added dependencies against the GitHub Advisory Database.
Performs secret scanning for exposed credentials.
Conducts a quality review, attempting fixes before asking for your review.
No extra config. No GHAS requirement. Available across all paid Copilot plans (except explicitly disabled managed user account repos). It summarizes the actions taken in the draft PR so reviewers see what was auto-remediated.
Two major platform upgrades are now generally available:
Rust language support joins the GA set (C/C++, Java/Kotlin, JS/TS, Python, Ruby, C#, Go, GitHub Actions, Swift). Coverage includes all OWASP Top 10 categories except A06 (handled via Dependabot). See available queries: https://codeql.github.com/codeql-query-help/rust/
Build‑free C/C++ scanning (default setup uses build mode none) drastically reduces adoption friction. During preview: >10,000 repos enabled, >70% success without manual intervention; one customer onboarded 1,400 repos in <48h.
Available on github.com, CodeQL CLI 2.23.3, and GitHub Enterprise Server 3.20+.
🛠 Assign Code Scanning Alerts to Copilot (Public Preview)
You can now delegate remediation of CodeQL code scanning alerts to Copilot coding agent, extending automation from feature work into security fixes.
Workflow:
Generate Autofix suggestions (alert page, security campaign, or REST API).
Assign Copilot (bulk via campaign or individually via alert detail).
Copilot drafts a remediation PR → applies changes → hands off for review.
Track progress through links in the UI per alert.
Supported for GitHub Code Security or GitHub Advanced Security users with Copilot coding agent on GitHub Enterprise Cloud.
Want deeper per‑PR security summaries? Multi‑repo campaign dashboards? Enhanced remediation analytics? Join the discussion and tell us what accelerates secure velocity for your org.
Secure more; stall less. 🛡️⚡
(Need a compliance-focused memo, social teaser, or internal enablement guide? Ask and I’ll generate it.)
📣 ANNOUNCEMENTAnnouncements from the GitHub Community teamCode SecurityBuild security into your GitHub workflow with features to keep your codebase secureUniverse 2025githubuniverse.com Oct. 28-29
1 participant
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
A trio of security-focused upgrades is here to help you ship faster and safer: Copilot coding agent now auto‑validates the code it writes, CodeQL adds Rust and build‑free C/C++ scanning to GA, and you can assign code scanning alerts directly to Copilot for automated fixes.
✅ Copilot Coding Agent: Built‑In Security & Quality Validation
When Copilot coding agent creates new code, it now:
No extra config. No GHAS requirement. Available across all paid Copilot plans (except explicitly disabled managed user account repos). It summarizes the actions taken in the draft PR so reviewers see what was auto-remediated.
Visit the changelog for more information.
🦀 + ⚙️ CodeQL GA: Rust Support & Build‑Free C/C++ Scanning
Two major platform upgrades are now generally available:
build mode none) drastically reduces adoption friction. During preview: >10,000 repos enabled, >70% success without manual intervention; one customer onboarded 1,400 repos in <48h.Available on github.com, CodeQL CLI
2.23.3, and GitHub Enterprise Server 3.20+.🛠 Assign Code Scanning Alerts to Copilot (Public Preview)
You can now delegate remediation of CodeQL code scanning alerts to Copilot coding agent, extending automation from feature work into security fixes.
Workflow:
Supported for GitHub Code Security or GitHub Advanced Security users with Copilot coding agent on GitHub Enterprise Cloud.
Visit the changelog for more information.
🚀 Why This Matters
⚡ Quick Start
build mode none.🔧 Implementation Tips
copilot-setup-steps.ymlthat includes any internal security bootstrap.📊 Success Signals to Watch
📘 References
💬 Feedback
Want deeper per‑PR security summaries? Multi‑repo campaign dashboards? Enhanced remediation analytics? Join the discussion and tell us what accelerates secure velocity for your org.
Secure more; stall less. 🛡️⚡
(Need a compliance-focused memo, social teaser, or internal enablement guide? Ask and I’ll generate it.)
Beta Was this translation helpful? Give feedback.
All reactions