Briefing
On October 15, 2026, GitHub made AI Scan for pull requests generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell scripts, Terraform and Dockerfiles.
The limits matter for any team that relies on it. AI Scan findings do not fail the code scanning check and cannot block merges through ruleset requirements. It does not run on pull requests from forks or on pull requests created by Dependabot. It is available for public repositories, while private and internal organization repositories require GitHub Code Security or GitHub Advanced Security, and usage consumes Code Security AI credits. A Copilot license is not required.
For a small development team, this is a useful second reviewer, not a control. A control is something that stops a vulnerable change from shipping.
What to do
- Enable AI Scan on repositories that contain PHP, scripts, Terraform or Dockerfiles, if your plan includes it.
- Add a branch rule requiring a human approval on every pull request, and make reviewing AI Scan findings part of that approval.
- Cover the gaps: review Dependabot updates and fork contributions through a separate checklist.
- Set a budget for Code Security AI credits so scanning does not stop silently when credits run out.
- Track findings to closure in the same system you use for other security work.
How to verify
- Open a test pull request with a known insecure pattern and confirm a finding appears.
- Confirm the branch protection rule blocks merging without approval.
- Review the AI usage report monthly to confirm scans are running.
Sources
- GitHub Changelog, AI Scan for pull requests generally available, Oct 15, 2026
- CISA, Cybersecurity Performance Goals 2.0
Want help putting this in place? Contact Computer Plus.