GitHub is introducing AI-powered security detections in GitHub Code Security to expand vulnerability coverage beyond what CodeQL's static analysis supports alone. The new hybrid detection model adds coverage for Shell/Bash, Dockerfiles, Terraform (HCL), and PHP, surfacing findings directly in pull requests. In internal testing,
Table of contents
Expanding application security coverage with static analysis and AIBringing expanded security coverage into pull requestsTurning expanded detection into review-ready fixes with Copilot AutofixEnforce security outcomes at the point of mergeTags:Written bySort: