Updated just now

Share this article

Related News

GitHub budgets are now searchable across scopes, products and users

Oct 13, 2026

GitHub budgets are now searchable across scopes, products and users

GitHub has replaced paginated budget hunting with one searchable list for personal, organization and enterprise accounts. Filters can narrow by scope, product, SKU or user, but operators still need to distinguish alerts from hard spending limits.

GitHubbillingAI credits

GitHub makes withdrawn Dependabot alerts distinguishable from missing ones

Oct 13, 2026

GitHub makes withdrawn Dependabot alerts distinguishable from missing ones

Dependabot now emits a withdrawn webhook action before removing an invalid alert, while REST reads and updates return 410 Gone. Security integrations can preserve the withdrawal event without misclassifying it as an unknown alert.

GitHubDependabotsupply chain security

GitHub Copilot CLI can discover Ollama models without making the session offline

Oct 12, 2026

GitHub Copilot CLI can discover Ollama models without making the session offline

Copilot CLI 1.0.94-0 adds local Ollama discovery to the model picker. It does not install models, guarantee tool support or enable offline mode, so developers still need to verify the runtime, endpoint and network path.

GitHubGitHub Copilot CLIOllama

GitHub adds AI Scan findings and autofix metrics to security overview — Source: OpenTools Team. Source-based editorial diagram: AI Scan measurement funnel: findings, developer response and interpretation limits.Source image

Application Security

GitHub adds AI Scan findings and autofix metrics to security overview

By OpenTools Team

GitHub security overview now separates AI Scan from CodeQL and reports findings, remediation, repository trends and autofix use. The public preview helps rollout decisions, but the dashboard measures workflow activity rather than vulnerability prevention.

Security overview now gives AI Scan its own measurement tab

GitHub's October 13 announcement adds AI Scan for pull requests to organization and enterprise security overview. The page formerly named CodeQL pull requests is now Code scanning on pull requests, with separate CodeQL and AI Scan tabs.

The AI Scan tab reports total findings, findings with and without an autofix suggestion, findings resolved, remediation rate, repositories that generated findings, trends for the selected reporting period, and how often developers applied autofix suggestions. Existing CodeQL metrics move under the CodeQL tab.

The separation prevents unlike engines from being silently combined. Teams can inspect AI Scan activity without treating it as additional CodeQL output.

The dashboard answers rollout questions at organization scale

A security team can now see where AI Scan produces findings, whether developers resolve them and whether autofix suggestions are used, without opening every pull request. That supports bounded questions such as which repositories are active, whether remediation is occurring and where enablement deserves follow‑up.

Use the selected reporting period and repository coverage as part of every readout. A raw finding count is difficult to compare when pull‑request volume, repository participation or rollout dates differ. Preserve the denominator inputs separately if the dashboard does not expose a directly comparable rate.

An increase after rollout can mean greater coverage or detection rather than worsening code. Pair the dashboard with enablement and pull‑request volume before drawing a trend conclusion.

Remediation and autofix use are workflow signals, not prevention proof

GitHub says the metrics include a remediation rate and the frequency with which developers apply autofix suggestions. Those signals describe response to findings. They do not by themselves establish that AI Scan prevented exploitable vulnerabilities, reduced production incidents or found every relevant flaw.

Keep the claims narrow: generated, resolved and suggestion‑applied counts can measure adoption and handling. Security efficacy needs a separate design with validated findings, comparable coverage and an outcome definition. A low autofix‑use rate can reflect suggestion quality, local policy or developers choosing a manual fix.

Review a small sample of closed findings before changing rollout policy. Confirm whether the resolution was an applied suggestion, a different patch, dismissal or code change that removed the finding.

Availability is limited to cloud customers with security products

The release is a public preview on GitHub.com, including GitHub Enterprise Cloud, for customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server is not supported for this release.

The current AI‑powered security detections documentation should be used to verify the feature's supported surfaces and behavior as preview details change. Record account plan, deployment type and reporting period with each dashboard capture.

A missing tab can therefore mean unsupported deployment, missing product access, insufficient administrator permissions or no enabled repositories. Diagnose those states before interpreting an empty chart as zero findings.

A useful first review compares coverage, findings and response

Start with the enabled repository set and the reporting window. Record repositories with activity, total findings, findings with autofix, resolved findings and suggestion applications. Then inspect outliers rather than ranking teams from one aggregate rate.

Repeat on a fixed cadence only after the cohort is stable enough to compare. Keep CodeQL and AI Scan series separate, because each engine and rollout can have different coverage. Treat the preview dashboard as an operational baseline, not a causal experiment.

The new metrics make AI Scan easier to govern at scale while preserving the need for validation and context. Follow GitHub's OpenTools organization page for related security releases.

Figure: The AI Scan measurement funnel from findings through remediation and autofix use. Sources: GitHub's announcement and the AI‑powered security detections documentation. Figure by OpenTools Team; no third‑party expressive material used.

Sources

1.AI-powered security detections documentation (docs.github.com)
2.github.blog (github.blog)

Tags

GitHubAI Scancode scanningapplication securitysecurity metrics