Briefing
GitHub announced on October 15, 2026 that AI Scan for pull requests is generally available. It complements CodeQL by scanning pull request changes in languages CodeQL does not cover well, including PHP, Shell scripts, Terraform and Dockerfiles. Those are the languages behind many small business websites, customer portals and infrastructure scripts.
GitHub is explicit about the limits. AI Scan findings are advisory. They do not fail the code scanning check and cannot block a merge through ruleset requirements. Scans do not run on pull requests from forks or on pull requests created by Dependabot. Private repositories need GitHub Code Security or GitHub Advanced Security, and the scans consume Code Security AI credits.
Most businesses we support do not write code, but they do hire someone who does: the web developer, the portal vendor, the contractor who scripts network changes. If that work lives in GitHub, a scan comment that nobody reads protects nothing.
What to do
- Ask each vendor that writes code for you where the code lives and whether any automated security scanning runs on changes.
- If they use AI Scan, ask who reviews the findings and whether a person must approve security findings before release.
- Ask how they cover changes the scanner skips, such as dependency updates and contributions from forks.
- Keep network and phone system configuration scripts in version control with a second person reviewing each change.
- Make sure you, not only the vendor, have admin access to the repository that holds your site or portal.
How to verify
- Request a recent example of a scan finding and how it was resolved.
- Confirm the repository owner account belongs to your business.
- Review the list of people with write access and remove anyone who no longer works on the project.
Sources
- GitHub Changelog, AI Scan for pull requests generally available, Oct 15, 2026
- CISA, Cybersecurity Performance Goals 2.0
Questions about your phones, network or IT? Contact Texwan.