GitHub announced a public preview of "/security-review" in the Copilot app on July 14, 2026. Developers can run an on-demand security check on in-flight project changes without leaving the Copilot workspace or waiting for a pull request to be complete.
The command analyzes current workstream changes and returns high-confidence findings scored by severity and confidence. It also provides actionable suggestions that developers can apply and reverify. GitHub says the results are presented as a focused, prioritized view so teams can address the issues that matter before code lands.
The preview covers common high-impact vulnerability classes, including injection flaws, cross-site scripting, insecure data handling, path traversal, and weak cryptography. These risks are not limited to traditional web applications. When an AI agent can read files, call tools, or generate code, unvalidated input can become an entry point into later operations.
GitHub positions "/security-review" as a complement to CodeQL, Dependabot, and secret scanning rather than a replacement. It is a lightweight, on-demand check for the development phase: run it while changes are being made, apply a fix, and reverify in the same workflow. That makes it useful for shifting security left, but it should not be treated as a complete release security gate.
For AI-assisted development, the important change is that security review is becoming part of the agent interface. Developers can ask Copilot not only to generate code, but also to assess the code it just created or modified. The findings still need engineering judgment: teams must confirm context, investigate false positives, and apply repository tests, permissions, and deployment policies.
GitHub says "/security-review" is available during public preview to Copilot Free, Pro, Business, and Enterprise users. That lowers the barrier to early checks, while enterprises still need to decide which files, data, and security results can be processed by a cloud-based agent and which sensitive changes require extra approval.
The broader trend is that AI coding tools are moving from code generation into the code-quality and security loop. If these checks become part of daily development, security review does not have to be concentrated at the end. Trust still depends on placing AI suggestions alongside deterministic scanners, automated tests, and human approval points in the same delivery pipeline.
