GitHub’s new AI-powered tool auto-fixes vulnerabilities in your code

GitHub announced Code Scanning Autofix, an AI-driven capability powered by Copilot and CodeQL that suggests and explains fixes for security issues in JavaScript, TypeScript, Java, and Python within GHAS private repositories, claiming to address the majority of alert types with minimal edits. The feature aims to reduce application security debt by enabling developers to remediate vulnerabilities during coding, with C# and Go support planned, while advising validation of suggested fixes. The announcement also highlights GitHub’s default push protection for public repos and prior widespread exposures of secrets.