The problem
How it works
GitHub’s application card for its security AI features explains how Autofix works. For each CodeQL alert it sends the alert data, short snippets around the source, sink and flow locations, the first lines of each file involved and the query’s help text to a language model. The model writes a fix and an explanation, which appear as a suggestion on the pull request or on the alert. It covers a subset of CodeQL queries in C#, C and C++, Go, Java and Kotlin, Swift, JavaScript and TypeScript, Python, Ruby and Rust, works on existing alerts on the default branch too, is on by default wherever CodeQL runs, and does not need a Copilot subscription.
Results and limitations
GitHub says it tests Autofix on more than 2,300 alerts from public repositories by merging suggestions unedited and rerunning code scanning and tests, and that many could be committed as-is. It gives no overall rate, so the case is marked planned.
Before you try it
GitHub lists the failure modes plainly: suggestions can be wrong, in the wrong place, change behaviour, only partly fix the issue, or add new vulnerabilities, and they can add dependencies with made-up names. Keep CI tests and dependency review on pull requests, and review every suggestion as you would a colleague’s. Complex multi-file data flows and very large files are less likely to get a fix. Results depend on your setup and were not independently reproduced by Top 200 Repos.
Tools and repositories
No ranked repository is involved. This use case still stands on its own source.
- Tools
- GitHub code scanning with CodeQL · Copilot Autofix
- Prerequisites
- A GitHub repository with CodeQL code scanning enabled.
Try it yourself: Review an Autofix suggestion before accepting it
Fill the fields to adapt the prompt. Empty fields stay as visible [placeholders].
Here is a CodeQL alert and the fix Copilot Autofix suggested: [Alert and suggested fix]. The code is [Language] and its intended behaviour is [Intended behaviour]. Check whether the fix removes the vulnerability on every path, whether it changes behaviour for valid input, and whether it adds or changes any dependency. Suggest tests that would prove the fix, and say whether you would accept, edit or reject it.Run the suggested tests in CI before merging.
Sources
- Application card: GitHub security and quality AI features (opens in a new tab)
Project documentation · docs.github.com · Undated · Source checked 12 Nov 2026, 18:03 UTC
What this source supports
- Copilot Autofix generates fix suggestions with explanations for CodeQL alerts on pull requests and the default branch, and does not require a Copilot subscription
- Inputs are SARIF alert data, snippets around the flagged locations, the first lines of involved files and the query help text
- Supported languages: C#, C/C++, Go, Java/Kotlin, Swift, JavaScript/TypeScript, Python, Ruby and Rust, for a subset of queries
- Limitations include syntax, location and semantic errors, partial or misleading fixes, and fabricated dependencies; human review is required
- An internal harness of over 2,300 alerts tests unedited suggestions against code scanning and the repositories’ tests