What happened
GitHub added a /security-review command to the GitHub Copilot app, the desktop coding-agent client that went free for every plan last week. Type the command in a project with pending changes and it scans your current edits, not the whole repository, and returns findings scored by severity and confidence.
The scan targets common, high-impact bug classes: injection flaws, cross-site scripting, insecure data handling, path traversal, and weak cryptography. Each finding comes with a suggested fix you can apply and reverify without leaving the app. The feature is in public preview and available on every tier, including Copilot Free.
Why it matters
GitHub positions /security-review as a complement to code scanning, Dependabot, and secret scanning. The difference is timing: it checks local changes while you are still working, before you commit or open a pull request.
That timing matters more if you’re building solo. Larger engineering teams may have a second set of eyes before code merges. If you’re shipping through an agent with no reviewer, an on-demand scan adds a useful checkpoint.
Its scope is also a limitation. The command reviews pending changes and the context it can inspect. It may miss a flaw elsewhere in the repository, a vulnerable dependency, an exposed secret, an unsafe cloud setting, or a problem that only appears when the app runs.
Who should care
Anyone using the Copilot app as their main coding agent, especially if security was not part of your background before you started building with AI. If you read our piece on the app going free last week, this is a practical reason to open it: the public preview is available from Copilot Free through Enterprise.
What builders should do next
Open the Copilot app, make the changes you are working on, and type /security-review in the chat. Review each finding before you commit, and re-run the check after making fixes.
Do not treat a clean result as proof that the app is secure. Keep repository-wide code scanning, dependency alerts, secret scanning, tests, and human review where available. For authentication, payments, permissions, or sensitive data, also test the running application from more than one user role.
End of article