GitHub has made an AI feature generally available to find security vulnerabilities before code changes are merged. Teams can extend reviews to languages and configuration files beyond existing tools. However, the new results are advisory information for human review, not judgments that block merges.

1. Filling gaps in existing analysis

GitHub announced the general availability of AI Scan on October 15, 2026. It finds vulnerabilities in pull requests, complementing languages and frameworks not currently supported by the existing code analysis tool CodeQL. It was not announced as a replacement for existing checks.

Supported languages include PHP and Shell/Bash. Scanning covers changes to shell scripts as well as languages used for web applications.

Terraform configurations and Dockerfile are also covered. This means infrastructure configuration and files for building container images can be examined during change reviews. The announcement says other targets are supported as well.

2. Enabling the setting brings results into change reviews

For AI Scan to run automatically, code scanning must be enabled, along with the feature setting that applies to the repository. Using code scanning alone does not mean it will run automatically. The announcement provided no specific settings menu paths or example commands.

Findings appear alongside CodeQL results in the pull request conversation and changed-files views. An AI label distinguishes them from existing analysis alerts, and they may include security risk explanations and automated fix suggestions. Whether a fix is included can vary by finding, so results require review and judgment.

3. It cannot be used to block merges

AI Scan findings are advisory. They do not fail code scanning checks and cannot block merges through repository rulesets that define merge requirements. Teams should therefore incorporate responsibility for reviewing findings and deciding on fixes into their review process.

It does not run on pull requests from forks or those created by Dependabot. When reviewing external contributions or dependency updates, teams need to check whether these exclusions actually apply, rather than considering only who authored the changes.

4. Eligibility depends on repository type

It is available for public repositories owned by organizations or personal accounts. Organization-owned private and internal repositories require GitHub Code Security or GitHub Advanced Security. Availability for public repositories and licensing requirements for private repositories should be checked separately.

A separate GitHub Copilot license is not required. Adoption decisions therefore start with repository type and security product eligibility, not a coding assistant subscription.

5. Consider broader scanning alongside credit consumption

The benefit is bringing gaps in existing analysis into the change review interface. Teams must also manage the work of reviewing additional findings and their usage. AI Scan consumes Code Security AI Credits, so eligibility and credit consumption from execution need separate consideration.

Usage appears under the Advanced Security product in the AI usage section of the enterprise billing and licensing page.

Credit budgets can be set by SKU, a product identifier. However, the announcement did not specify credit prices, consumption per run, or whether execution stops automatically when a budget is reached.

AI Scan is not a blocking mechanism that replaces existing security checks, but a complementary tool that broadens review coverage while requiring human review and credit management.