Code scanning AI Scan no longer requires CodeQL default setup
AI Scan for pull requests can now find security vulnerabilities without requiring CodeQL default setup to be enabled on a repository, expanding its accessibility for security scanning workflows.
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.
What’s changed
Code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level, if the organization belongs to an enterprise. The same permission hierarchy still applies. There’s no new setup step. If you’ve already enabled GitHub code scanning’s AI Scan for your organization, it now runs more broadly across your eligible repositories, regardless of whether CodeQL default setup is configured.
This change is now in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for this release.
To learn more, see our docs about AI-powered security detections.
Join the discussion and leave feedback on GitHub Community.
The post Code scanning AI Scan no longer requires CodeQL default setup appeared first on The GitHub Blog.
Source: original entry ↗
More from GitHub
Follow GitHub to get its new changes in your feed and email digest.
Copilot model policy API for enterprise, orgs, and teams
REST API endpoints now available to retrieve and update Copilot model policies for enterprises, teams, apps, and organizations, enabling centralized policy management at scale.
GitHub Copilot models deprecated
GitHub has deprecated certain models across GitHub Copilot experiences including Chat, inline edits, and code completions, effective October 19, 2026. Users may need to migrate to supported models.
Some Git over HTTPS may temporarily require authentication
GitHub may temporarily require authentication for clones and fetches of public repositories over HTTPS during periods of unusual traffic to protect service availability.