GitHub broadens AI Scan for pull requests beyond CodeQL default setup

GitHub has made its AI Scan for pull requests easier to use by removing a dependency that narrowed where the feature could run. The September 16 changelog says AI Scan can now find security vulnerabilities in pull requests even when CodeQL default setup is not enabled on a repository. Code scanning and AI Scan still need to be enabled at the repository, organization, or enterprise level, and GitHub says the same permission hierarchy still applies.

The change matters because CodeQL default setup is useful, but it is also a deployment step that not every team has completed across every repository. Security programs often have a long tail of smaller projects, archived services, experiments, and personal repositories that receive less tooling attention than flagship applications. GitHub's update means organizations that already turned on AI Scan can get broader pull request coverage across eligible repositories without adding a new setup step for each one.

What changed for teams

GitHub says the public preview now covers organization owned and personal repositories on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported in this release. The practical boundary is important. This is not a universal code scanning rollout for every GitHub user, and it does not remove the need for administrators to enable the underlying security features. It reduces one configuration condition after that decision has already been made.

For developers, the useful part is where the alert appears. Pull request scanning can catch suspicious changes while a reviewer still has context, before the code becomes part of the default branch or enters a release path. That can make the tool more actionable than a later backlog of security alerts, especially for teams that already rely on pull requests as the normal review checkpoint.

What to watch next

The CyberOGZ read is that this is a governance improvement more than a magic detection upgrade. Wider coverage is valuable only if teams define how AI generated security findings are triaged, who can dismiss them, and when a finding should block a merge. Broadening an AI scanner without a response process can create noise. Broadening it with clear ownership can make security review less dependent on every repository having identical setup maturity.

Teams already using GitHub Advanced Security should check whether AI Scan is enabled at the right scope and whether repositories that previously lacked CodeQL default setup are now receiving pull request findings. Teams on GitHub Enterprise Server will need to wait for a separate supported release before planning around this workflow.

Sources

• github.blog

Cover photo by Oluwaseun Duncan on Pexels, used under the Pexels License.