Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more.

AI Scan runs automatically on pull requests when code scanning and the repository’s effective AI Scan setting are enabled. Findings appear alongside CodeQL results on the Conversation and Files changed tabs, with an “AI” indicator to distinguish them from CodeQL alerts. Findings can include an explanation of the security risk and a suggested autofix.

AI Scan findings are advisory. They do not fail the code scanning check and cannot block pull request merges through ruleset requirements. AI Scan does not run on pull requests from forks or pull requests created by Dependabot.

AI Scan is available for public repositories owned by organizations or personal accounts. For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security is required. A GitHub Copilot license is not required.

AI Scan for pull requests consumes Code Security AI Credits. AI Credit usage is displayed in the “AI usage” section of enterprise billing and licensing as the “Advanced Security” product. You can also set SKU-level budgets for Code Security AI Credits. Learn more about usage-based billing.

Learn more about AI Scan for pull requests and billing for GitHub Advanced Security AI features.

Join the discussion in the AI Scan Community discussion.