GitHub’s new AI-powered tool auto-fixes vulnerabilities in your code

GitHub introduced a new AI-powered feature capable of speeding up vulnerability fixes while coding. This feature is in public beta and automatically enabled on all private repositories for GitHub Advanced Security (GHAS) customers.

Known as Code Scanning Autofix and powered by GitHub Copilot and CodeQL, it helps deal with over 90% of alert types in JavaScript, Typescript, Java, and Python.

After being toggled on, it provides potential fixes that GitHub claims will likely address more than two-thirds of found vulnerabilities while coding with little or no editing.

"When a vulnerability is discovered in a supported language, fix suggestions will include a natural language explanation of the suggested fix, together with a preview of the code suggestion that the developer can accept, edit, or dismiss," GitHub's Pierre Tempel and Eric Tooley said.

The code suggestions and explanations it provides can include changes to the current file, multiple files, and the current project's dependencies. 

Implementing this approach can significantly reduce the frequency of vulnerabilities that security teams must handle daily. 

This, in turn, enables them to concentrate on ensuring the organization's security rather than being forced to allocate unnecessary resources to keep up with new security flaws introduced during the development process.

However, it's also important to note that developers should always verify if the security issues are resolved, as GitHub's AI-powered feature may suggest fixes that only partially address the security vulnerability or fail to preserve the intended code functionality.

"Code scanning autofix helps organizations slow the growth of this "application security debt" by making it easier for developers to fix vulnerabilities as they code," added Tempel and Tooley.

"Just as GitHub Copilot relieves developers of tedious and repetitive tasks, code scanning autofix will help development teams reclaim time formerly spent on remediation."

The company plans to add support for additional languages in the coming months, with C# and Go support coming next.

More details about the GitHub Copilot-powered code scanning autofix tool are available on GitHub's documentation website.

Last month, the company also enabled push protection by default for all public repositories to stop the accidental exposure of secrets like access tokens and API keys when pushing new code.

This was a significant issue in 2023, as GitHub users accidentally exposed 12.8 million authentication and sensitive secrets via more than 3 million public repositories throughout the year.

As BleepingComputer reported, exposed secrets and credentials have been exploited for multiple high-impact breaches [1, 2, 3] in recent years.