GitHub Advanced Security gets AI to auto-fix code and catch leaked passwords

Finding security vulnerabilities in code is annoying. Fixing them is worse. For years, security scanners have dumped alert backlogs onto developers without giving them the actual fix, while hardcoded passwords quietly slip past rule-based scanners because they don't look like neat API keys.

GitHub is trying to close that loop. The platform rolled out a preview of three AI-powered features for GitHub Advanced Security, alongside a major overhaul of its security dashboard, aiming to turn passive alerts into one-click patches.

Autofixing code directly inside pull requests

The headline feature is code scanning autofix. Built on top of GitHub's CodeQL static analysis engine, the tool now handles JavaScript and TypeScript vulnerabilities by piping alerts through an advanced large language model to generate code remedies.

Instead of just pointing out a flaw, the system drops suggested fixes right onto the Conversation and Files Changed tabs of the pull request. Developers can review the diff, edit the proposed patch if needed, or simply commit it into the branch on the spot.

GitHub is also using LLMs to tackle generic leaked passwords in secret scanning. Traditional regex engines struggle with passwords because human-created secrets lack standard formats. The new AI detector flags unstructured secrets with lower false positives, placing them in a separate Other tab so security teams can triage them without cluttering high-confidence alert queues.

For enterprise teams with custom token formats, GitHub added an AI regular expression generator. Admins answer a few plain-language questions through a form, and the model writes the regex pattern, complete with real-time dry runs before deployment.

Rounding out the release is an upgraded security overview dashboard. Security leads can now track historical trends across three pillars: open risks, remediation speed (like mean time to remediate), and prevention metrics from tools like push protection.

Why it matters

Security tools have always suffered from an alert-to-action problem. Scanners generate noise, developers ignore backlogs, and security debt piles up. We think embedding LLM-generated fixes directly into pull requests is the smartest move here: it meets developers where they already work and removes the research overhead required to patch CodeQL alerts.

For dev teams running heavy JS and TS codebases, this is worth testing immediately. Slashing the friction between vulnerability detection and commit should materially cut remediation times.

For the wider industry, this puts tremendous pressure on standalone application security testing vendors. When your code host can scan, detect unstructured leaks, draft regex rules, and write the pull request patch natively, paying for a separate scanning tool becomes a tough sell.

That said, the obvious risk is over-trust. Large language models can hallucinate logic flaws while resolving a syntax vulnerability. If developers treat these autofixes like spellcheck and merge without rigorous review, they risk trading a known vulnerability for an invisible architectural bug.