Scan pull-request changes for vulnerabilities beyond CodeQL’s coverage
Added to DistroCool on 2026-10-22 · Discovery date, not a release announcement
GitHub’s AI Scan for pull requests is generally available and runs alongside CodeQL when code scanning and AI Scan are enabled. It targets changed code in additional languages and formats including PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP and Blazor, and can attach a risk explanation and suggested autofix.
Why it matters
This adds an automated security review where CodeQL coverage is incomplete, without requiring a GitHub Copilot license. Findings are advisory: they cannot fail the code-scanning check or block a merge, and scans do not run for forked or Dependabot pull requests. Public repositories are supported; private and internal organization repositories require GitHub Code Security or Advanced Security, and usage consumes Code Security AI Credits.
Try this next.
Enable AI Scan on a low-risk public repository or a licensed test repository, then open a pull request with a known non-production security test case in a supported language. Compare its advisory with CodeQL, verify any suggested fix manually, and keep an independent merge gate such as tests or human security review. DistroCool has not independently tested this example.
Open the practical workflow →Source: GitHub Changelog — October 15, 2026 ↗