Connect with us

Hi, what are you looking for?


Application Security

GitHub Rolls Out ‘Code Scanning Autofix’ in Public Beta

GitHub’s code scanning autofix delivers remediation suggestions for two-thirds of the identified vulnerabilities.

GitHub security

GitHub on Wednesday announced the public beta availability of code scanning autofix, a new feature meant to help developers address code vulnerabilities faster.

Initially announced in November 2023, code scanning autofix relies on GitHub’s AI-powered code completion tool Copilot and semantic code analysis engine CodeQL to identify vulnerabilities in JavaScript, Typescript, Java, and Python repositories, and provide fix suggestions for them.

According to the Microsoft-owned code hosting platform, the feature can suggest remediation for more than two-thirds of the identified flaws.

“Our vision for application security is an environment where found means fixed. By prioritizing the developer experience in GitHub Advanced Security, we already help teams remediate 7x faster than traditional security tools,” GitHub says.

With code scanning autofix, the platform aims to significantly reduce the time developers spend on addressing bugs and help enterprises slow the growth of unaddressed vulnerabilities in production repositories.

“Security teams will also benefit from a reduced volume of everyday vulnerabilities, so they can focus on strategies to protect the business while keeping up with an accelerated pace of development,” GitHub notes.

Fix suggestions for bugs identified in the supported programming languages include natural language explanations and previews of the code suggestions that developers can accept, edit, or dismiss.

The code suggestions include changes to the current file and may include changes to multiple files and dependencies that should be added to the project, GitHub says.

Advertisement. Scroll to continue reading.

Next, the code hosting platform will add support for C# and Go, followed by other programming languages.

GitHub has made available resources and documentation about the system and encourages developers to join the autofix feedback and resources discussion.

Code scanning autofix is now available in beta for all GitHub Advanced Security customers.

Related: GitHub Enhances Security Capabilities With AI

Related: GitHub Enterprise Server Gets New Security Capabilities

Related: GitHub Announces New Security Improvements

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Kim Larsen is new Chief Information Security Officer at Keepit

Professional services company Slalom has appointed Christopher Burger as its first CISO.

Allied Universal announced that Deanna Steele has joined the company as CIO for North America.

More People On The Move

Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.