From alert to proposed change
GitHub announced general availability of agentic autofix for code-scanning alerts on October 15. It says the agent explores relevant files, proposes a change, reruns CodeQL, and opens a draft pull request for review. The feature supports alerts on the default branch, not alerts found only on other branches or pull requests.
Access requires eligible GitHub Enterprise Cloud security products, administrator enablement, and a Copilot billing method. GitHub says usage consumes Code Security AI Credits and Actions minutes. This is not an announcement of a free feature for every repository.
Source: GitHub: Agentic autofix for code scanning alerts general availability ↗
Give the reviewer two different questions
Our suggested review separates the alert from the application. First, inspect what evidence says the reported issue was addressed. Second, ask whether the application still behaves as intended. Those questions overlap, but they are not interchangeable.
For a fictional file-import feature, a patch might change how an input is handled. A reviewer could inspect the changed files, compare the intended behavior before and after, and check ordinary as well as invalid inputs. Keep this investigation within a repository you are authorized to work on; a review exercise does not require probing a live service.
Ask for a concise explanation of why each changed file is relevant. If the patch expands beyond the reported problem, understand that expansion before deciding whether it belongs in the same pull request.
Start with one understandable handoff
If you have eligible access, choose a single alert whose surrounding code your team can review. Read the validation summary and inspect the actual diff before considering a merge. This is a suggested pilot, not a report that we ran the feature.
Record what the agent changed, what its checks covered, and what a person checked separately. If you do not have access, the same review note can be used for an existing manually prepared patch.
The useful outcome is a proposed fix with evidence attached. Do not turn a cleared alert into a claim that the entire application is secure or that further review is unnecessary.
Try this, then make it yours.
Add two headings to your next patch-review note: evidence for closing the issue, and behavior that still needs checking.
Explore the tool ↗Follow the signal.
Our reporting starts here. Practical suggestions are our analysis, and vendor performance statements are claims unless independently verified. We haven’t hands-on tested this release.
