The Copilot-powered code scanning autofix is powered by GitHub Copilot and CodeQL, and covers more than 90% of alert types in JavaScript, TypeScript, Java, and Python, and delivers code suggestions shown to remediate over two-thirds of found vulnerabilities with little or no editing.

GitHub senior product marketing manager Eric Tooley said, “Our vision for application security is an environment where ‘found means fixed’. By prioritizing the developer experience in GitHub Advanced Security, we are already helping teams remediate 7x faster than traditional security tools. Code scanning autofix is the next leap forward, helping developers dramatically reduce time and effort spent on remediation.

“Even though applications remain a leading attack vector, most organizations admit to an ever-growing number of unremediated vulnerabilities that exist in production repositories. Code scanning autofix helps organizations slow the growth of this ‘application security debt’ by making it easier for developers to fix vulnerabilities as they code,” adds Tooley. 

Just as GitHub Copilot relieves developers of tedious and repetitive tasks, code scanning autofix will help development teams reclaim time formerly spent on remediation. Security teams will also benefit from a reduced volume of everyday vulnerabilities, so they can focus on strategies to protect the business while keeping up with an accelerated pace of development.

When a vulnerability is discovered in a supported language, fix suggestions will include a natural language explanation of the suggested fix, together with a preview of the code suggestion that the developer can accept, edit, or dismiss. In addition to changes to the current file, these code suggestions can include changes to multiple files and the dependencies that should be added to the project.

Behind the scenes, code scanning autofix leverages the CodeQL engine and a combination of heuristics and GitHub Copilot APIs to generate code suggestions.

GitHub will continue to add support for more languages, with C# and Go up next. Developers can join the autofix feedback and resources discussion to share their experiences and help guide further improvements to the autofix experience. GitHub says it is committed to moving application security closer to a place where a vulnerability found means a vulnerability fixed.