GitHub made AI Scan for pull requests generally available on October 15, 2026. The feature complements CodeQL for selected languages and frameworks outside its current coverage. Its most consequential limitation is easy to miss: AI Scan findings are advisory, do not fail the code-scanning check and cannot themselves block a merge through ruleset requirements.
Additional coverage with explicit boundaries
GitHub lists examples including PHP, Shell/Bash, Terraform configuration, Dockerfiles, JSP and Blazor. Findings appear on pull requests with an AI indicator and may include an explanation or suggested remediation. This is not a full-repository scan or a replacement for an existing CodeQL backlog.
The documentation excludes pull requests from forks and those created by Dependabot. It also warns that AI findings can be false positives. A review process therefore needs to distinguish an unsupported change, a scan that did not run, a clean result and a finding a reviewer has investigated. Those states should not all become a green security label.
Related sources: GitHub: AI Scan general-availability announcement ↗ · GitHub Docs: AI Scan for pull requests ↗
Availability does not mean unlimited free scanning
Public organization and personal repositories are supported, while private or internal organization repositories require GitHub Code Security or Advanced Security. A Copilot licence is not required. Private personal repositories and managed-user personal namespaces have different restrictions described in the documentation.
Usage consumes Code Security AI Credits. GitHub says a hard budget with no available credits prevents findings until the budget changes or a new billing cycle starts. Before organization-wide enablement, check the responsible billing account, included credits and budget controls. This article does not quote a price or estimate savings.
Related sources: GitHub: AI Scan general-availability announcement ↗ · GitHub Docs: AI Scan for pull requests ↗
A practical rollout for Canadian software teams
AI Speed recommends beginning with a small set of repositories that includes representative supported code and known security-review cases. Record whether scanning ran, which findings were actionable and the effort needed to validate them. Keep human security review and existing tests in place rather than treating a new detector as proof that code is safe.
For Canadian organizations handling sensitive software, review the applicable service terms and internal code-access approvals before enabling another AI workflow. Measure confirmed issues resolved and missed coverage, not just alert volume. General availability establishes a product-release stage; it does not independently establish detection accuracy on your application.
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- GitHub: AI Scan general-availability announcement ↗ — October 15, 2026 release; advisory status, availability and billing.
- GitHub Docs: AI Scan for pull requests ↗ — Current coverage, exclusions, budget behavior and administration; checked October 17, 2026.