On 15 October 2026, GitHub announced general availability of AI Scan for pull requests, which propose changes to code. The tool complements CodeQL in languages and frameworks outside its current coverage, including PHP. For a business with a custom website, this is a reason to discuss change checks with its developer, rather than evidence that the finished site is secure.
What gets checked
According to GitHub’s announcement, findings marked AI appear on the pull request and may include a risk explanation and suggested fix. They are advisory: they do not fail the code scanning check and cannot block merging through repository rules. Pull requests from forks or Dependabot are excluded.
Availability and costs
The documentation defines access by repository ownership. Public repositories owned by organizations or personal accounts are supported; private and internal organization repositories require GitHub Code Security or GitHub Advanced Security. Private personal-account repositories are unsupported. Repositories in a managed user account’s personal namespace are unsupported. A Copilot license is not required.
Scanning consumes Code Security AI Credits, including in public repositories. Under the billing rules, included credits are used first where available; usage is metered after they run out, or from the start if none are included. Feature availability does not mean usage is free.
What to ask your developer
Our editorial recommendation: check repository eligibility, agree a budget and assign someone to review findings before merging. Organization-level enablement immediately covers all eligible repositories with code scanning enabled. Full-repository scanning is unsupported, and false positives are possible.
Bottom line: the new check can supplement a development workflow, but the team remains responsible for releasing changes.
Author: Nadali. Prepared by the editorial team using AI. Sources checked on 19 October 2026.
