Pimp My IDE / security shop
Back to garage
15 Oct 2026 / application security / review control

A new sensor is not a merge brake.

GitHub AI Scan can find pull-request problems outside current CodeQL coverage. GitHub also says its findings are advisory. Keep the signal, the repair, the validating query, and the merge decision on separate controls.

Treat an AI finding as a lead with a source location. Promotion to a project verdict still needs reproduction, impact, and a reviewer who can say no.

PR sensor / advisory laneMerge authority / none
Three signals can inform review.Reviewer owns verdict.
Signal and authority are different circuits

AI Scan adds coverage without pretending to be CodeQL.

GitHub released AI Scan for pull requests on October 15. It targets languages and frameworks outside current CodeQL coverage, including PHP, Shell, Terraform configuration, Dockerfiles, JavaServer Pages, and Blazor. Findings appear beside CodeQL results with an "AI" marker.[1]

The marker matters. GitHub says AI Scan findings are advisory. They do not fail the code scanning check, and repository rulesets cannot use them to block a merge. The scanner also skips pull requests from forks and Dependabot.[1]

Coverage went up. Authority did not.

Autofix closes one alert, not the review.

GitHub released agentic autofix for default-branch code scanning alerts on the same day. When assigned an alert, the agent inspects related files, drafts a change, reruns CodeQL, and opens a draft pull request for review. A user can group up to 25 alerts into one repair request.[2]

A clean rerun supports a narrow claim. It shows that the query which raised the alert no longer raises it on that revision. It does not prove that product behavior stayed correct, that a different vulnerability was not introduced, or that an AI Scan lead outside CodeQL coverage was resolved by an equivalent witness.

GitHub's own guidance keeps a person on the brake.

GitHub's application card says developers should evaluate a proposed fix, decide whether it fits their codebase, and check that intended behavior remains intact. It also lists weak output, false positives, false negatives, incomplete fixes, and new vulnerabilities as possible limits of generated suggestions.[3]

This is the useful operating model. The machine can find, explain, draft, and rerun a query. A maintainer still owns reachability, threat-model fit, product tests, severity, and merge.

Wire the queue around claim level.

  1. Label AI Scan output as an advisory lead. Preserve the file, line, explanation, and scanner identity.
  2. Reproduce the risky behavior or state why the result cannot be reproduced. Pin the revision and environment.
  3. Review the patch against the full change, not only the alert location. Run the query and the product tests that guard intended behavior.
  4. Record the project verdict, impact, reviewer, and remaining coverage gap. Do not turn "alert closed" into "system secure."

The control below teaches that handoff. It does not connect to a repository or run either GitHub feature.

Interactive control / verdict press

Move the claim, not the goalposts.

Traditional purpose replaced: a flat alert-status menu. Better version: each detent shows what exists, what it can claim, who has authority, and which check must happen next.

Finding review stage
Detent 1 / advisory lead

The scanner found a candidate.

Keep the location, explanation, and AI marker. Do not assign project severity until a reviewer checks reachability and impact.

RecordSource-linked finding
Claim allowedAI Scan reported a possible vulnerability on this pull request.
AuthorityAdvisory only. It cannot block the merge through a ruleset.
Next checkReproduce the behavior at a pinned revision.

Review packet

This press drafts a review record. It does not inspect a repository, reproduce a finding, run CodeQL, validate a fix, assign severity, or grant merge approval.
Sources read / 15 Oct 2026

Evidence drawer

GitHub changelog

AI Scan for pull requests

Documents covered gaps, pull-request placement, the AI marker, advisory status, merge-rule limits, exclusions, access, and billing.

Read the release note
GitHub changelog

Agentic autofix

Documents default-branch alert assignment, repository inspection, draft generation, CodeQL reruns, draft pull requests, access, and billing.

Read the release note
GitHub documentation

Security AI application card

Documents intended uses, review duties, supported inputs, and limits such as false results, incomplete fixes, and behavior regressions.

Read the application card
Source boundary. These are three first-party GitHub pages. They explain GitHub's products and stated limits. They do not provide independent measurements of finding quality or fix quality. This article did not enable AI Scan, submit an alert, spend AI credits, or run agentic autofix.