Skip to content
NewsProduct launch

GitHub's AI Scan for pull requests reaches GA without a Copilot license requirement

· by Pondero Newsdesk

The short version

GitHub moved AI Scan for pull requests to general availability on October 15, 2026, and its own changelog says a Copilot license is not required, opening the vulnerability scanner to every public repository at no added license cost.

GitHub's AI Scan for pull requests reaches GA without a Copilot license requirement

GitHub's AI Scan for pull requests left public preview on October 15, 2026, and GitHub's own changelog spells out a detail that widens who can turn it on: "A GitHub Copilot license is not required," per GitHub's GA changelog entry. That line matters because it decouples the scanner's billing from Copilot seat purchases entirely, so a security team already paying for GitHub Advanced Security does not need to also buy Copilot licenses just to run it.

What shipped

The scanner complements CodeQL's static analysis by catching vulnerabilities in languages and frameworks CodeQL does not cover, including PHP, Shell/Bash, Terraform configuration files, Dockerfiles, JSP for Java, and Blazor for C#, per GitHub's documentation. It runs automatically on a pull request once code scanning and the repository's AI Scan setting are both on, posting findings to the Conversation and Files changed tabs beside CodeQL alerts, tagged with an "AI" indicator, per GitHub's changelog. A finding can carry a plain-language risk explanation and a suggested autofix. GitHub's documentation groups results into nine categories, among them string injection, broken access control, weak cryptography, server-side request forgery, and supply-chain risks such as unpinned third-party actions.

Access now splits by repository ownership, not by license tier

GitHub's documentation lays out availability as a grid rather than a single rule: a public repository owned by an organization or a personal account gets AI Scan with no active-committer license needed, while a private or internal organization repository still requires GitHub Code Security or GitHub Advanced Security, the documentation states. Billing runs on a separate "Code Security AI Credits" meter rather than through Copilot seats. If the billing account already holds included AI credits from a Copilot entitlement, AI Scan draws from those first before metering starts, and a hard budget with no credits left simply pauses scanning until an administrator raises the limit or a new billing cycle begins. For a team deciding whether to flip AI Scan on, the calculation is no longer about Copilot procurement. It is whether the existing Advanced Security coverage and AI-credit budget can absorb the extra scans, since findings consume credits only when a qualifying pull request is actually scanned.

Two limits stand out: AI Scan only reads pull request diffs, not a full repository, and findings cannot yet be wired into rulesets to block a merge, GitHub's documentation notes. It also skips pull requests opened from forks or by Dependabot.

What to watch next

GitHub has not said when, or whether, AI Scan will gain ruleset-enforced blocking, full-repository scans, or fork support. The supported-language and detection-category lists are both marked as subject to change as the feature evolves, so the next changelog entry to watch for is any expansion of either list.

Sources