GitHub AI Scan for Pull Requests: Setup, Costs, and Safe Review

GitHub AI Scan for pull requests is an AI-based security scanner that examines code changed in a pull request. It became generally available on October 15, 2026, with an emphasis on languages and frameworks that CodeQL does not currently cover directly, including PHP, Shell and Bash, Terraform configuration in HCL, Dockerfiles, JSP for Java, and Blazor for C#.

The important caveat is that AI Scan produces review signals, not security guarantees. Its findings are advisory, they cannot currently be required by a ruleset to block a merge, and false positives are possible. A useful rollout therefore needs more than turning on a toggle. You also need a review process, a credit budget, and a clear boundary between AI findings, CodeQL, tests, and human security review. 한국어로 읽기.

What problem AI Scan is designed to solve

Traditional static analysis is strongest when a language has mature parsing, data-flow models, and security queries. Real repositories are less tidy. A product may combine application code with deployment scripts, infrastructure definitions, container files, server templates, and older frameworks. Coverage can vary significantly across those files.

AI Scan focuses on the changes entering through a pull request. It adds findings for selected areas outside current CodeQL coverage and places them in the same pull-request workflow developers already use. A finding can explain the risk and, in many cases, include a suggested remediation or Copilot Autofix proposal.

A scan runs only when the required conditions are met: code scanning is enabled for the repository, the effective AI Scan setting is enabled, and an eligible pull request contains a change in a supported language or framework. Scans run when a pull request is opened and after new commits are pushed. Pull requests from forks and pull requests created by Dependabot are excluded.

AI Scan does not require CodeQL default setup and does not depend on a successful CodeQL analysis. If CodeQL is waiting or fails, AI Scan can still run. The two systems may also finish at different times, so one set of results can appear before the other.

Area	AI Scan	CodeQL
Primary scope	Changed code in eligible pull requests, extending coverage beyond current CodeQL languages	Static and data-flow analysis for supported languages
Where results appear	Conversation and Files changed tabs, marked AI	Pull requests and code-scanning alerts in repository security views
Historical full-repository scan	Not supported	Available depending on the setup
Merge enforcement	Findings are advisory and cannot currently be a required ruleset check	Can participate in broader security policy and review workflows

An official example of an AI-labeled finding, risk explanation, and suggested fix beside pull-request code. Source: GitHub Changelog, checked October 18, 2026.

Check eligibility and billing before enabling it

Availability depends on repository ownership and visibility:

• Organization-owned public repositories: available without an active-committer license.
• Organization-owned private or internal repositories: require GitHub Code Security or GitHub Advanced Security.
• Personal-account public repositories: available.
• Personal-account private repositories: not available.
• Managed-user personal namespaces: not eligible, even if code scanning is enabled.

A GitHub Copilot license is not required. That does not mean every scan is free. AI Scan consumes the Code Security AI Credits SKU when a qualifying pull request is scanned. If the billing account has included AI credits through an eligible Copilot entitlement, those credits are used first. Further usage can become metered, subject to the account’s budgets.

A hard budget can stop AI Scan from producing new findings when no Code Security AI Credits remain. Scanning resumes when an administrator raises the limiting budget or a new billing cycle begins. Public repositories can avoid active-committer licensing charges while still consuming AI credits for this feature, so security and billing administrators should review the same rollout plan.

How to enable AI Scan for an organization

1. Review enterprise policy. In an enterprise, an enterprise owner must allow organizations to enable AI Scan. The policy starts as Not allowed. Allowing the feature does not enable it automatically.
2. Open organization settings. Select your profile picture, choose Organizations, and open Settings for the intended organization.
3. Open global security settings. In the Security section, expand Advanced Security and select Global settings.
4. Enable AI Scan. In the code-scanning settings, select AI Scan. Eligible repositories with code scanning enabled inherit the organization setting immediately.
5. Handle repository exceptions. Repository administrators can opt out after the organization enables AI Scan. They cannot opt in when the organization setting is disabled.

For a public repository owned by a personal account, an administrator can use the AI Scan for pull requests toggle under the repository’s Code scanning settings. There is no model-selection step.

After enabling the feature, use the Coverage view in security overview to confirm the effective status for each repository. This catches cases where enterprise policy, organization inheritance, repository eligibility, or code-scanning configuration prevents the setting from taking effect.

Design a safe first pull request

Start with a small, disposable, and reviewable change instead of enabling the feature across every active repository. A useful pilot might change one Terraform network rule, harden a Dockerfile, or improve quoting and validation in a Bash deployment script. Do not add a real secret or merge intentionally vulnerable code into the default branch just to trigger a result.

1. Create a separate branch in a repository that contains a supported file type.
2. Open a pull request with one focused security-related change.
3. Check the Conversation and Files changed tabs for findings carrying the AI label.
4. Read the described attack path and compare it with the actual input, validation, and execution flow.
5. If a remediation is suggested, review the diff, run tests, and verify least-privilege behavior before accepting it.
6. Push the revised commit and check whether the finding is resolved or replaced with a more specific result.

If no finding appears, do not treat that as proof that the change is secure. Check, in order, whether code scanning is enabled, whether the effective AI Scan setting is enabled, whether the file type is in scope, whether the pull request comes from a fork or Dependabot, and whether a hard AI-credit budget has stopped output.

Four questions to ask about every finding

1. Does untrusted input reach the risky operation?

For string injection, path traversal, SSRF, and similar categories, trace the value from its source to the operation being flagged. Validation, allowlists, framework escaping, or an unreachable path may change the risk. A familiar code shape alone is not enough to confirm a vulnerability.

2. Does the proposed fix preserve required behavior?

A remediation that removes a shell argument or closes a network rule can break deployment behavior. Validate the change with unit tests, integration tests, a Terraform plan, container builds, or the equivalent environment-specific check.

3. Are you exposing sensitive context while reviewing or giving feedback?

Do not paste customer data, tokens, incident details, or private logs into comments to explain a false positive. Share the minimum context needed and redact sensitive values.

4. Is the team treating an advisory result as a merge gate?

AI Scan findings do not fail the Code scanning check and cannot currently be enforced as required ruleset conditions. Keep branch protection, tests, secret scanning, CodeQL where supported, and human review in place.

Three practical rollout examples

Example 1: Terraform change review

An infrastructure team can begin with pull requests that change public exposure, encryption, logging, or identity permissions. Review each AI finding beside the Terraform plan and the organization’s cloud policy. Record the outcome as fixed, accepted risk, or false positive, with a short reason. This creates a measurable pilot rather than a collection of unexplained alerts.

Example 2: Deployment scripts and Dockerfiles

A platform team can pilot AI Scan on repositories where Bash and Dockerfile changes are frequent. Focus review on command injection, unverified downloads, overly broad privileges, and unpinned packages or images. Suggested fixes should be tested for build reproducibility and runtime permissions before merge.

Example 3: A legacy PHP service

For a PHP application outside current CodeQL coverage, prioritize changes that connect user-controlled values to SQL, HTML, file paths, redirects, or outbound requests. Compare AI Scan with an existing PHP analyzer. Separate duplicate findings, genuinely new categories, and false positives to estimate whether broader enablement is worth the credit usage.

The official Security overview for monitoring AI Scan findings, resolution trends, and autofix availability across an organization. Source: GitHub Changelog, checked October 18, 2026.

Monitor the rollout instead of counting alerts alone

Organization and enterprise security overview includes AI Scan coverage and reporting. The AI Scan tab in the pull-request code-scanning report can show findings over time, which findings had an autofix suggestion, and outcomes for findings with or without a suggestion. The broader Prevention view can show generated and resolved findings and how often developers applied an autofix.

Useful pilot measures include the percentage of findings confirmed by reviewers, the time required to review them, the types of files producing useful results, the false-positive rate, accepted remediations, and Code Security AI Credit consumption. A high alert count does not automatically mean better coverage. Expand only when the team can review results consistently and the signal justifies the cost.

Limitations to document for the team

• AI Scan analyzes pull-request changes, not historical code across the entire repository.
• Findings are advisory and cannot currently block a merge through ruleset requirements.
• Pull requests from forks and Dependabot are not scanned.
• Supported languages, frameworks, and detection categories may change.
• False positives are possible, and no finding is not proof of safety.
• Custom instruction files such as /.github/copilot-instructions.md or /CLAUDE.md do not control the specialized prompts used by the scanner.
• A Copilot seat is not required, but qualifying scans can consume Code Security AI Credits.

Rollout checklist

• Confirm repository ownership, visibility, and license eligibility.
• Review included credits and create a Code Security AI Credits budget.
• Confirm code scanning and the effective AI Scan status in Coverage.
• Start with a small group of repositories and supported file types.
• Require human review and environment-appropriate tests for suggested changes.
• Document the fork, Dependabot, full-repository, and merge-enforcement limitations.
• Measure useful findings, false positives, remediation outcomes, and credit use before expanding.

Bottom line

GitHub AI Scan is best understood as a complementary pull-request security layer. It can add coverage where CodeQL does not currently analyze the language or framework, but it does not replace CodeQL, secret scanning, tests, branch protection, or expert review. The safest adoption path is to verify eligibility and budgets, enable a small pilot, validate findings with real code flow and tests, monitor organization-level outcomes, and expand only when the signal is useful.

Official sources

• GitHub Changelog: AI Scan for pull requests generally available
• GitHub Docs: AI Scan for pull requests
• GitHub Docs: Configuring global security settings
• GitHub Docs: Advanced Security AI feature billing

Sources checked October 18, 2026.