Where should AI security review stop? A three-stage design for work-in-progress, pull requests, and remediation¶

For / Key Points

For: Development teams using AI coding agents while retaining existing CodeQL checks and pull-request approvals.

Key points:

In-progress review, PR detection, and alert remediation cover different scopes and have different enforcement power.
AI security detections on pull requests are informational and do not block merges by themselves.
Design the owner and evidence transferred between stages instead of counting AI review results.

Published: 2026-07-17

Developers can now run /security-review while working, see AI detections on a pull request, and ask Copilot to remediate a code-scanning alert. Three green surfaces do not mean the same assurance has passed three times.

GitHub released these capabilities in public preview during July 2026.¹²³ This article asks one question: where should each AI security review stage stop, and what evidence should it pass forward?

The question must be reframed. Decide who stops a change when evidence is missing, rather than which additional AI review to enable.

Do not call three different capabilities one gate¶

The three stages are not one automatic linear pipeline. Their trigger, scope, prerequisites, cost, and enforcement power differ.

Stage	Scope and trigger	Access and cost	What this result can stop by itself
In-progress review	A developer runs `/security-review` against current changes in the Copilot app	Available to Copilot Free, Pro, Business, and Enterprise users during public preview	The developer can choose to hold the pull request
AI detection on a PR	The AI detection engine runs when a pull request opens or updates	Requires Code Security, CodeQL default setup, a Copilot license, and AI Credits	It shows an informational finding; it does not block a merge
Alert remediation	A code-scanning alert is assigned to Copilot	Requires Code Security or Advanced Security, a Copilot license with cloud agent enabled, AI Credits, and Actions minutes	It opens a remediation draft PR; it does not approve or merge it

In-progress review is a lightweight check that returns high-confidence findings and suggested actions for current changes. GitHub describes it as complementing code scanning, Dependabot, and secret scanning, not replacing them.¹

PR-level AI detection broadens coverage to languages and frameworks beyond CodeQL's current native support, but its findings are explicitly informational. Treating it as a required check creates a dangerous mismatch: the interface can show a warning while branch protection still permits the merge.²

Agentic autofix is a different job again. It explores an alert, proposes a change, reruns analysis, and opens a draft PR, but it does not approve the validity of that new change.³

Assign a stopping owner to each stage¶

Define a stop by who can authorize resumption after inspecting which evidence, not by whether an AI produced a finding. Collapsing every result into a security reviewed label hides responsibility transfers.

Stage	Stopping owner	Stop condition	Evidence passed forward
In progress	Change author	The diff is not fixed in scope or a finding has no disposition	Commit, review timestamp, finding, and disposition
Pull request	Repository or security owner	A required check fails, sensitive ownership is missing, or an alert is unresolved	PR, scanner identity, status, and approver
Remediation	Fix-PR reviewer	The source alert is unclear, analysis was not rerun, or regression tests are missing	Alert ID, fix commit, reanalysis, CI, and rollback

The first stage is an author stop. Before opening the PR, fix the review scope and either remediate each finding or record evidence for its disposition.

The second stage is a repository stop. Because the AI detection itself has no merge-blocking power, sensitive repositories must connect it to real controls such as required CodeQL checks, CODEOWNERS, or security-owner approval.

The third stage is a remediation-change stop. A draft PR opened by autofix responds to an alert, but it is also a new code change. Closing the original alert does not prove that authentication behavior or unrelated paths still work.

Scenario: route an authentication middleware change¶

Assume an AI coding agent changes authentication middleware and modifies the default behavior for unauthenticated requests. Routing this one change through the three stages exposes each capability's boundary.

Freeze the in-progress scope. Create the candidate commit at the end of the agent session and run /security-review on that diff. Link each finding to its file, severity, confidence, and disposition.
Separate detection sources on the PR. Record AI-labeled findings, CodeQL, secret scanning, and tests as separate rows. State that the AI finding is informational.
Connect actual enforcement. Require a security-owner approval for authentication paths and use CodeQL and tests as required checks. Keep the AI finding as decision input.
Treat remediation as a new change. If an alert is assigned to Copilot, require its draft PR to include the alert ID, rerun analysis, regression tests, and rollback method.
Return evidence to the original PR. Make the fix commit and supporting evidence traceable from the original finding instead of recording only that the warning disappeared.

This workflow does not trust AI three times. It turns one stage's uncertain output into evidence that the next stage can test.

Separate the cost ledger from the assurance ledger¶

Combining every AI security cost into a Copilot seat price makes stage-level growth invisible. At minimum, PR detections and agentic autofix consume AI Credits during public preview. Autofix also consumes GitHub Actions minutes.²³

Keep five fields in the operating ledger.

Scope: Branch, commit, diff, and repository.
Source: Copilot app, AI detection, CodeQL, or third-party scanner.
Semantics: Advisory, informational, or required.
Disposition: Remediated, false positive, risk accepted, or held, plus its owner.
Lineage: Alert, fix PR, reanalysis, and merge decision.

Finding count is a poor KPI because broader detection can look better simply by producing more output. Track confirmed defects, false-positive rate, disposition time, recurrence, and stage-level AI Credits and Actions minutes instead.

Stop rollout on five unresolved conditions¶

Do not make AI security review a required operating step while any of these remain.

AI detections and CodeQL findings are collapsed into one status.
An informational result is presented as a required check.
Finding disposition and risk-acceptance owners are undefined.
Alert, fix PR, reanalysis, and original PR are not mutually traceable.
No owner controls limits, shutdown, and reporting for AI Credits and Actions minutes.

Detection quality can change throughout public preview. Place the stop mechanism in missing evidence, not in assumptions about one model's intelligence.

Summary¶

In-progress review, PR-level AI detection, and agentic autofix support decisions made by the author, repository owner, and remediation reviewer. Keep their scope, enforcement, cost, and evidence separate instead of producing one AI security passed status.

More review passes do not automatically create defense in depth. The design becomes layered defense only when each stage stops a different failure and converts the previous stage's claim into testable evidence.

GitHub, Security reviews now available in the GitHub Copilot app, July 14, 2026 (accessed July 17, 2026). ↩↩
GitHub, Code scanning shows AI security detections on pull requests, July 14, 2026 (accessed July 17, 2026). ↩↩↩
GitHub, Agentic autofix for code scanning alerts in public preview, July 10, 2026, updated July 16, 2026 (accessed July 17, 2026). ↩↩↩