GitHub adds Copilot security reviews for code changes before merge

GitHub announced a public preview of /security-review for the GitHub Copilot app on July 14, adding an AI-assisted security check for code changes before they land.

What GitHub announced

In a GitHub Changelog post, GitHub said the new /security-review slash command analyzes “in-flight code changes” and returns high-confidence security findings with actionable fixes. The feature is designed to run inside the Copilot app workflow, so developers can ask for a security review while they are still working on a change rather than waiting for a later audit or release-stage scan.

GitHub’s Copilot CLI command reference also lists /security-review [PROMPT] as a command that runs a security review capability to analyze changes for vulnerabilities. That documentation indicates the command can be invoked with an optional prompt, giving developers some control over the review request.

QATechTools, writing about the launch on July 15, reported that the review output includes severity, confidence and suggested action for findings. Newsdesk similarly described the command as a public-preview feature in the Copilot app that returns prioritized suggestions for high-confidence findings without requiring developers to leave the Copilot workflow.

Why it matters for development teams

The announcement reflects a broader shift in software development: security feedback is moving closer to the moment code is written. Traditional application security reviews often happen during pull request checks, scheduled scans or later-stage release processes. GitHub’s new Copilot command is positioned earlier, when a developer can still adjust a diff before it is merged.

That timing matters because the cost of remediation is typically lower before code is integrated into a larger branch or shipped to production. A developer who receives a specific fix suggestion while working on a change can address the issue in context, instead of revisiting the code after a separate security report.

The public-preview status is also important. GitHub is not presenting the feature as a replacement for established secure development practices. The Changelog language emphasizes high-confidence findings and actionable fixes, which suggests a targeted review experience rather than a comprehensive guarantee that all vulnerabilities will be found.

Where it fits alongside existing tools

GitHub already offers security-focused tooling such as code scanning and dependency-related alerts across its platform. The new /security-review command adds a conversational, Copilot-based entry point for reviewing current changes. Based on GitHub’s Changelog and documentation, its role is to help developers surface likely security issues earlier in their workflow.

Teams adopting the feature should still treat it as one layer in a broader security process. Deterministic checks, code review, threat modeling, dependency management and tested secure coding standards remain relevant because AI-assisted review can miss issues or produce suggestions that need validation. The useful change is not that one command can replace those practices, but that developers now have another way to request security feedback before a change is finalized.

For organizations already using GitHub Copilot, /security-review could become a lightweight first pass for common security mistakes in active code changes. For security teams, the practical question will be how its findings compare with existing static analysis, manual review and CI checks during the public-preview period.