GitHub AI Scan for PRs Goes GA: Covering CodeQL's Blind Spots, Deliberately Kept Out of Merge Gates

On October 15, GitHub moved AI Scan for pull requests to general availability. This is not another "AI-powered" marketing label: it fixes a genuinely old problem — the languages and frameworks CodeQL doesn't cover have been flying blind in pull requests for years. Now PHP, shell scripts, Terraform configs, and Dockerfiles get scanned before merge. But GitHub wrote a telling limitation into the same announcement: AI Scan findings are purely advisory. They cannot fail a check, and they cannot block a merge through rulesets. A doctor who may diagnose but may not prescribe — why did GitHub design it that way? And the part of this GA that will actually move a team's budget sits in the back half of the announcement: the billing rules.

What happened: GA on October 15, no Copilot license needed

Per GitHub's official changelog (published 2026-10-15), AI Scan for pull requests is out of public preview. Its positioning has been clear from the start: complement CodeQL by finding vulnerabilities in "languages and frameworks that CodeQL does not currently cover." The GA announcement names PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, and Blazor for C#, "and more." For many teams that list reads like an inventory of legacy corners: deploy scripts, infrastructure as code, container definitions — exactly the files static analysis has historically neglected and where security issues love to hide.

Enabling it is straightforward: with code scanning on and the repository's AI Scan setting enabled, scans run automatically on pull requests. Findings appear alongside CodeQL results on the PR's Conversation and Files changed tabs, each carrying an "AI" indicator so you can tell them apart from CodeQL alerts. A finding can include a plain-language explanation of the security risk and a suggested autofix.

The most surprising line in the GA announcement for many readers: "A GitHub Copilot license is not required." It matters because during public preview the docs required both a GitHub Advanced Security license and a Copilot license. GA dropped Copilot from the ticket list. Availability now splits by repository ownership and visibility: public repositories owned by organizations or personal accounts get it directly; private or internal organization-owned repositories need GitHub Code Security or GitHub Advanced Security. Private repositories under personal accounts are not covered.

What it actually scans: nine detection categories

GitHub's documentation groups AI Scan findings into nine categories, each with a precise definition — the best way to understand the tool's field of vision:

• String injection: unsafely built SQL, HTML, shell, JSON, or YAML with missing or incorrect escaping or sanitization. The classic shape:

// User input concatenated straight into SQL — the classic string-injection shape
$id = $_GET['id'];
$rows = $pdo->query("SELECT * FROM users WHERE id = $id");

// Fix: parameterized query, value separated from statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$_GET['id']]);

• Weak cryptography: weak algorithms, small keys, insecure randomness, missing encryption, weak password hashing.
• Broken access control: path traversal, CSRF gaps, user-driven open redirects.
• Sensitive data exposure: secrets, tokens, passwords, or stack traces stored, logged, or sent without adequate protection.
• Security misconfiguration: risky defaults, such as disabling security controls or enabling debug features.
• Authentication failures: missing TLS or validation, insecure authentication flows, missing rate limiting.
• Data integrity failures: unsafe deserialization, HTTP for sensitive actions, prototype pollution, executing untrusted content.
• Server-side request forgery (SSRF): server fetches attacker-controlled URLs, hosts, or protocols.
• Supply chain risks: unpinned third-party actions, packages, or images, or downloads without integrity checks.

Note the last one: unpinned third-party actions are themselves an AI Scan detection category. That rhymes interestingly with the other story in this batch — GitHub Actions lockfiles: GitHub is warning you in PRs that "this action isn't pinned" while shipping a mechanism to pin actions. Two product lines pushing in the same direction in the same month is not a coincidence.

A few runtime details worth remembering: AI Scan analyzes PR code without requiring a build system, and may use code search to gather more context from the repository; it uses specialized prompts and ignores your repo's copilot-instructions.md or CLAUDE.md; scans trigger on PR creation and after each new commit, on the same cadence as CodeQL; and it no longer requires CodeQL default setup — even if CodeQL analysis fails or is still waiting, AI Scan runs anyway. The docs also include an honest line: as an AI-based tool, its findings may include false positives, and you can use the thumbs up/down feedback to report bad ones.

The most important fine print: advisory only, no merge blocking

Back to that opening limitation. GitHub states it three times, in wording that leaves no room for misreading, across the GA announcement and the docs: AI Scan findings are advisory, they do not fail the code scanning check, and they cannot be used in rulesets to enforce merge requirements. Plainly: it may comment on your PR, but it has no vote.

Why would GitHub deliberately strip its new tool of enforcement power? The docs' own admission — "findings may include false positives" — is the answer. CodeQL is deterministic static analysis with controllable false-positive rates, so its alerts can enter the backlog and gate merges. AI Scan is model-driven, and GitHub itself won't vouch for its precision, so it won't put it in the gate. Giving a fallible model veto power over merges would be a disaster for developer workflows — one false block and the team's trust in the whole security toolchain drops. GitHub's call is pragmatic: let the AI be a reviewer first, not a guard.

But that creates a real expectation gap: many teams hear "AI scans PRs" and immediately think "finally, vulnerable merges get blocked automatically and we can skip manual review." The GA reality blocks nothing. The correct usage is review comments — a human reviewer sees the "AI"-badged notes in Files changed and gets a second perspective; a security team watches trends and remediation rates in security overview to judge whether the scanner is helping or just adding noise. Teams hoping it replaces merge gates can drop that idea now, at least until GitHub ships ruleset support.

Two more "won't scan" boundaries matter just as much: PRs from forks aren't scanned, and neither are PRs opened by Dependabot. The first one hits open source hardest — outside contributors almost always open PRs from forks, which means the code an open-source repo most needs reviewed is invisible to AI Scan. The second is because Dependabot updates are already part of a trusted pipeline. And it only reads PR diffs, never doing full-repository scans: the PHP vulnerability you merged last year won't be dug up unless someone touches that code again.

The real bill: Code Security AI Credits

The part of the GA that actually moves team budgets is the billing. AI Scan isn't charged as Copilot seats but on a separate meter: Code Security AI Credits. In enterprise billing it shows up under the "AI usage" section as the "Advanced Security" product, and you can set SKU-level budgets.

The docs spell out the billing rules in detail, and each line is worth reading: first, if the billing account already holds included AI credits through a Copilot entitlement, AI Scan draws from those first, and metering starts only after they're exhausted; second, credits are consumed only when a qualifying pull request is actually scanned — no scan, no charge; third, if a hard budget runs dry, scanning simply pauses and stops producing findings until an administrator raises the limit or a new billing cycle begins. In other words, an exhausted budget has the same effect as switching the feature off — just passively.

There's a post-GA gotcha the docs flag in unmistakable terms: flipping the organization-level switch enables AI Scan immediately for every eligible repository with code scanning on. Repository admins can opt out afterward, but qualifying PRs start consuming Code Security AI Credits before they do. Shoot first, aim later — an admin who one-click-enables it org-wide may see the first AI Credits charge arrive earlier than expected. The docs' advice: before enabling at org level, confirm repository eligibility, inventory the billing account's included AI credits, and configure metered-usage budgets.

So "no Copilot license required" needs its full reading: it genuinely lowers the barrier — security teams no longer need to procure Copilot seats just to scan. But it doesn't make scanning free; it just moves the charge to a different ledger. For teams already paying for Advanced Security, the decision changes from "should we buy Copilot?" to "can our existing AI-credit budget absorb these scans?" Usage-based scanning naturally incentivizes pointing it where it matters: enable it first for the highest-risk repositories, not blindly org-wide.

The admin view: dashboards caught up the same week

Around the GA, GitHub filled in two missing pieces on the admin side. An October 13 changelog announced new AI Scan metrics in security overview (public preview). Organization and enterprise admins can now see how many AI Scan findings were generated and resolved, the remediation rate, which repositories produced findings, trends over a selected period, and how often developers accepted autofix suggestions — the last number is the one to watch, because it directly answers "is this scanner helping or adding noise?" At the same time, the old "CodeQL pull requests" page was renamed "Code scanning on pull requests" with separate CodeQL and AI Scan tabs, and the AI Scan tab further breaks out findings with versus without an autofix suggestion. The dashboard is available on github.com (including Enterprise Cloud) for GitHub Code Security or Advanced Security customers; Enterprise Server isn't supported in this release.

A week earlier (October 6), per multiple outlets quoting the changelog, GitHub had already put AI Scan enablement status into security overview's coverage view: admins can see counts of enabled vs. not-enabled repositories, inspect each repository's effective status row by row, filter with code-scanning-ai-scan-pr-scan:enabled / not-enabled, and get a new column in CSV exports. Note what this view answers: "is it on?" — not "how well is it scanning." Enabled doesn't mean scanned, and scanned doesn't mean fixed. Together, the two pieces complete GitHub's admin narrative: coverage first, effectiveness second.

Our take for vibe coders

If you write code with AI, this GA touches you directly in one way: AI Scan covers exactly the file types you produce most. A typical vibe-coding output includes plenty of PHP pages, deploy shell scripts, Dockerfiles, and Terraform configs — precisely the files CodeQL has never covered and AI Scan now does. Code that used to enter PRs relying on human eyeballs now gets an automated second pair of eyes, even if it occasionally cries wolf.

But three things to keep straight. First, don't treat it as a gate: it has no power to block merges today, so your merge protection still rests on your existing required checks; think of it as a review assistant and the mindset is right. Second, fork PRs are invisible to it — if you maintain an open-source project, external contributions still depend on humans and your existing process. Third, do the math: org admins should check AI-credit budgets before enabling, lest "one-click enable" becomes a billing surprise; individual public-repo users can just flip it on, no license barrier.

The longer-term read: GitHub's separation of "AI review" from "merge gating" is a design peers will likely copy. Model precision isn't at enforcement grade yet, but its recall already earns a reviewer seat. Separating advice from gating looks like a feature cut in the short term; in the long term it may be the most honest shape for AI security tooling — admit you can be wrong first, then talk about helping.

Sources

• GitHub Changelog: AI Scan for pull requests generally available (2026-10-15)
• GitHub Docs: AI Scan for pull requests (nine detection categories, availability matrix, billing rules)
• GitHub Changelog: Code scanning AI Scan metrics in security overview (2026-10-13)
• Pondero: GitHub's AI Scan for pull requests reaches GA without a Copilot license requirement (2026-10-16)