Coding Tools
GitHub Copilot adds security extension for in-app code scanning
GitHub Changeloghigh confidence
Why it matters
- →Eliminates context switching between security dashboards and IDEs during vulnerability remediation.
- →Integrates AI-driven fix generation directly into the developer's existing workflow.
- →Supports enterprise governance through admin-controlled plugin installation policies.
GitHub has released a public preview of a security extension for the GitHub Copilot app, enabling developers to address code scanning alerts without switching contexts. The extension integrates directly with repository code scanning data, allowing users to browse, filter, and dismiss alerts while using Copilot to explain or generate fixes for identified vulnerabilities. Fixes are applied only to local working copies, requiring manual review before committing, and the feature supports enterprise managed settings for plugin installation. Currently available on GitHub.com and GitHub Enterprise Cloud, the extension does not support GitHub Enterprise Server.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1GitHub Copilot App Adds Security Review Feature
GitHub Changelog · July 14, 2026 · Same story
- 2GitHub Copilot Expands Code Review Capabilities
GitHub Changelog · August 27, 2026 · Same story
Follow this story
Open the full story →GitHub Copilot Automations go team-shared
3 developments
- Oct 28 · GitHub Changelog
GitHub Copilot Automations go team-shared - Oct 28 · GitHub Changelog
GitHub Copilot adds security extension for in-app code scanning (This article)↳ GitHub Copilot adds a security extension that pulls code scanning alerts directly into the app for in-editor explanation and fixes. - Oct 28 · GitHub Changelog
GitHub Enterprise bundles Copilot access
More in Coding Tools
Coding Toolscoding
Claude Code v2.1.316: Subagents and Gateway Budgets
Anthropic is tightening control over Claude Code's autonomous behavior with new environment variables that let you disable 'ultrathink' or cap subagent effort levels. For teams, the introduction of pooled group budgets on the gateway allows shared monthly spending limits across members, a practical fix for enterprise cost management. The release also patches critical bugs where shell commands would hang or crash on exit, stabilizing the developer experience significantly.
Claude Code Releases
Coding Toolscoding
llama.cpp b12022 adds ROCm 10 and Snapdragon support
This release quietly cements llama.cpp as the universal inference runtime by finally bringing ROCm 10.0 to Linux and Windows alongside CUDA 13.4, effectively closing the hardware gap for AMD users who were previously left behind. The inclusion of native Snapdragon support on Linux marks a significant step toward running local LLMs on ARM-based mobile chips without emulation overhead. While KleidiAI on Apple Silicon is disabled in this build, the broader expansion to diverse accelerators ensures that developers aren't locked into NVIDIA ecosystems anymore.
llama.cpp Releases
Coding Toolscoding
llama.cpp b12023 fixes shared prefix bug
This release addresses a specific inference artifact where decision prefixes were incorrectly bleeding into output embeddings. By capping shared prefixes at the first output position, llama.cpp ensures that option tokens remain distinct for parent and child tasks. This is a targeted fix for multi-step reasoning or voting workflows rather than a performance boost. It stabilizes complex generation patterns without changing the underlying model architecture.
llama.cpp Releases