Complete AI Training
Sign inGet my AI kit

Your job's AI kit

Get your AI kit

Tell us who you are and what you do. We show you your kit right away and email you the link: skills, prompts, AI agents, MCP servers and courses for your job.

500+ jobs ready, and we make a kit for any other job. No payment needed to look.

Share

AI news ·

GitHub launches AI Scan for pull requests to find vulnerabilities CodeQL misses

GitHub's AI Scan for pull requests is now generally available, covering PHP, Shell, Dockerfiles, Terraform, and other languages that CodeQL does not support. Findings are advisory only, cannot block merges, and consume Code Security AI Credits without requiring a Copilot license.

1 min read
IT and developmentLegal

GitHub released AI Scan for pull requests to general availability on October 15, 2026. The feature expands code scanning beyond CodeQL's language coverage, finding vulnerabilities in pull request changes for PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java, Blazor for C#, and other languages CodeQL does not currently support.

How AI Scan operates

AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are both enabled. Findings appear alongside CodeQL results on the Conversation and Files changed tabs. An "AI" indicator separates these alerts from standard CodeQL results. Each finding can include an explanation of the security risk and a suggested autofix.

The feature is advisory only. AI Scan findings do not fail the code scanning check, and they cannot block pull request merges through ruleset requirements. The scan does not run on pull requests from forks or pull requests created by Dependabot.

Availability and licensing

AI Scan is available for public repositories owned by organizations or personal accounts. For private and internal organization-owned repositories, teams need GitHub Code Security or GitHub Advanced Security. A GitHub Copilot license is not required to use the feature.

Billing and credit consumption

AI Scan for pull requests consumes Code Security AI Credits. Usage appears in the "AI usage" section of enterprise billing and licensing, listed under the "Advanced Security" product. Organizations can set SKU-level budgets for these credits. GitHub has published additional documentation on usage-based billing for the feature.

For IT and development leaders, this release closes a practical gap. CodeQL's language coverage left several widely used technologies-shell scripts, Dockerfiles, and Terraform configs-without automated pull request scanning. AI Scan now covers those surfaces without requiring a Copilot license, though private repos still need a paid security subscription.

For legal and compliance reviewers, the advisory nature of the findings matters. AI Scan alerts cannot block merges through ruleset requirements. That means these results provide signal without creating a hard gate, which affects how teams document security review processes and satisfy audit requirements. Organizations tracking spend should also note that AI Scan draws from a separate credit pool, visible under Advanced Security in billing reports, with budget controls available at the SKU level.

Share