--- title: Security extension for the GitHub Copilot app | daily.dev description: GitHub has released a security extension for the GitHub Copilot app, now in public preview. It lets developers browse open code scanning alerts, ordered by... canonical: https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security extension for the GitHub Copilot app | daily.dev og:description: GitHub has released a security extension for the GitHub Copilot app, now in public preview. It lets developers browse open code scanning alerts, ordered by... og:url: https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2 og:image: https://api.daily.dev/og/posts/MDoY9o3W2.png og:image:alt: Security extension for the GitHub Copilot app og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security extension for the GitHub Copilot app **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 0 comments ## Summary GitHub has released a security extension for the GitHub Copilot app, now in public preview. It lets developers browse open code scanning alerts, ordered by severity, and ask Copilot to explain or fix them without leaving the app. Fixes are made only in the local working copy and aren't committed or pushed automatically. A /security-review command checks current changes and flags when code has changed since the last review. The extension installs via 'copilot plugin install github-security@awesome-copilot' and works with any Copilot plan, though full alert access needs code scanning and, for private repos, GitHub Code Security. It's unsupported on GitHub Enterprise Server. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I install the GitHub security extension for the Copilot app? Run 'copilot plugin install github-security@awesome-copilot' in your terminal, or open the GitHub Copilot app, click Customize, search for 'github-security', then click '+ Install'. The extension is automatically enabled afterward, and you can open the Security canvas from a session for your repository. _Developers rolling out new Copilot plugins can track setup changes like this one on daily.dev._ ### Does GitHub Copilot's security extension automatically commit fixes to my code scanning alerts? No, Copilot only makes fixes in your local working copy and doesn't commit or push anything automatically. This lets you review and iterate on the changes in the app before pushing when you're ready, keeping you in control of what actually gets merged. _Teams weighing AI-assisted remediation workflows can follow tooling updates like this on daily.dev._ ### What GitHub Copilot plan do I need to use the /security-review command? Any Copilot plan supports installing the extension and running /security-review on local changes. For Copilot Business and Copilot Enterprise, an administrator must enable the GitHub Copilot app policy and can use enterprise managed settings to control which plugins developers can install; viewing existing alerts additionally requires code scanning enabled, with GitHub Code Security needed for private repositories. _Admins planning Copilot rollouts can keep up with plan and policy requirements on daily.dev._ ## Similar posts on daily.dev - [Security reviews now available in the GitHub Copilot app](https://daily.dev/posts/security-reviews-now-available-in-the-github-copilot-app-yl2ya9sjw) · GitHub Changelog · 0 upvotes · 0 comments - [Dedicated security review command now available in Copilot CLI](https://daily.dev/posts/dedicated-security-review-command-now-available-in-copilot-cli-axzy516cd) · GitHub Changelog · 0 upvotes · 0 comments - [How exposed is your code? Find out in minutes—for free](https://daily.dev/posts/how-exposed-is-your-code-find-out-in-minutes-for-free-uh0cpjdxe) · GitHub Blog · 0 upvotes · 0 comments - [GitHub takes aim at Claude Code and Codex with its new Copilot app](https://daily.dev/posts/github-takes-aim-at-claude-code-and-codex-with-its-new-copilot-app-u5mftvizf) · The New Stack · 0 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#ai-coding](https://daily.dev/tags/ai-coding), [#appsec](https://daily.dev/tags/appsec), [#code-scanning](https://daily.dev/tags/code-scanning) [View this post on daily.dev](https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security extension for the GitHub Copilot app","url":"https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2"},"datePublished":"2026-10-28T16:16:54.210Z","dateModified":"2026-10-28T23:15:17.067Z","description":"GitHub has released a security extension for the GitHub Copilot app, now in public preview. It lets developers browse open code scanning alerts, ordered by...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ac6b7e3a7d5644ffb8cfd673ae61b778?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ac6b7e3a7d5644ffb8cfd673ae61b778?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,ai-coding,appsec,code-scanning","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Security extension for the GitHub Copilot app"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-extension-for-the-github-copilot-app-mdoy9o3w2#faq","mainEntity":[{"@type":"Question","name":"How do I install the GitHub security extension for the Copilot app?","acceptedAnswer":{"@type":"Answer","text":"Run 'copilot plugin install github-security@awesome-copilot' in your terminal, or open the GitHub Copilot app, click Customize, search for 'github-security', then click '+ Install'. The extension is automatically enabled afterward, and you can open the Security canvas from a session for your repository. Developers rolling out new Copilot plugins can track setup changes like this one on daily.dev."}},{"@type":"Question","name":"Does GitHub Copilot's security extension automatically commit fixes to my code scanning alerts?","acceptedAnswer":{"@type":"Answer","text":"No, Copilot only makes fixes in your local working copy and doesn't commit or push anything automatically. This lets you review and iterate on the changes in the app before pushing when you're ready, keeping you in control of what actually gets merged. Teams weighing AI-assisted remediation workflows can follow tooling updates like this on daily.dev."}},{"@type":"Question","name":"What GitHub Copilot plan do I need to use the /security-review command?","acceptedAnswer":{"@type":"Answer","text":"Any Copilot plan supports installing the extension and running /security-review on local changes. For Copilot Business and Copilot Enterprise, an administrator must enable the GitHub Copilot app policy and can use enterprise managed settings to control which plugins developers can install; viewing existing alerts additionally requires code scanning enabled, with GitHub Code Security needed for private repositories. Admins planning Copilot rollouts can keep up with plan and policy requirements on daily.dev."}}]} ```