{"id":77063,"date":"2024-03-20T09:00:40","date_gmt":"2024-03-20T16:00:40","guid":{"rendered":"https:\/\/github.blog\/?p=77063"},"modified":"2025-04-07T13:02:49","modified_gmt":"2025-04-07T20:02:49","slug":"found-means-fixed-introducing-code-scanning-autofix-powered-by-github-copilot-and-codeql","status":"publish","type":"post","link":"https:\/\/github.blog\/news-insights\/product-news\/found-means-fixed-introducing-code-scanning-autofix-powered-by-github-copilot-and-codeql\/","title":{"rendered":"Found means fixed: Introducing code scanning autofix, powered by GitHub Copilot and CodeQL"},"content":{"rendered":"\n

Copilot Autofix<\/a> is now generally available.<\/em><\/p>\n

Starting today, code scanning autofix<\/strong> will be available in public beta for all GitHub Advanced Security<\/a> customers. Powered by GitHub Copilot and CodeQL<\/a>, code scanning autofix covers more than 90% of alert types in JavaScript, Typescript, Java, and Python, and delivers code suggestions shown to remediate more than two-thirds of found vulnerabilities with little or no editing.<\/p>\n

Found means fixed<\/span><\/a><\/h2>\n

Our vision for application security is an environment where found means fixed. By prioritizing the developer experience in GitHub Advanced Security, we already help teams remediate 7x faster than traditional security tools. Code scanning autofix is the next leap forward, helping developers dramatically reduce time and effort spent on remediation.<\/p>\n

\"Code<\/p>\n

Even though applications remain a leading attack vector, most organizations admit to an ever-growing number of unremediated vulnerabilities that exist in production repositories. Code scanning autofix helps organizations slow the growth of this “application security debt” by making it easier for developers to fix vulnerabilities as they code.<\/p>\n

Just as GitHub Copilot<\/a> relieves developers of tedious and repetitive tasks, code scanning autofix will help development teams reclaim time formerly spent on remediation. Security teams will also benefit from a reduced volume of everyday vulnerabilities, so they can focus on strategies to protect the business while keeping up with an accelerated pace of development.<\/p>\n

Want to try code scanning autofix? If your organization is new to GitHub or does not yet have GitHub Advanced Security<\/a> (or, its prerequisite, GitHub Enterprise<\/a>), contact us<\/a> to request a demo and set up a free trial.<\/p>\n<\/div>\n

How it works<\/span><\/a><\/h2>\n

When a vulnerability is discovered in a supported language, fix suggestions will include a natural language explanation of the suggested fix, together with a preview of the code suggestion that the developer can accept, edit, or dismiss. In addition to changes to the current file, these code suggestions can include changes to multiple files and the dependencies that should be added to the project.<\/p>\n

\n\t\t\t