Skip to content Skip to footer

GitHub Launches Code Scanning Autofix Feature for Security – What You Need to Know

recently announced the launch of a new feature called “code scanning autofix,” which aims to provide targeted recommendations to to avoid introducing new security issues. This feature is now available in public beta for all Advanced Security customers.

Powered by Copilot and CodeQL, the code scanning autofix feature can deliver code suggestions that remediate over two-thirds of found vulnerabilities with little or no editing. Currently covering more than 90% of alert types in JavaScript, Typescript, Java, and , this feature uses a combination of CodeQL, Copilot APIs, and OpenAI GPT-4 to generate code suggestions.

The primary objective of this feature is to help resolve vulnerabilities as they code by providing potential fixes and natural language explanations when an issue is discovered in a supported language. The suggestions may go beyond the current file and include changes to other files and dependencies that should be added to fix the problem.

This feature was first previewed in November 2023, and it is expected to add support for more programming languages, including and Go, in the future.

Code scanning autofix is designed to lower the barrier of entry for by combining information on best practices with details of the codebase and alerts to suggest a potential fix. This allows to start with a code suggestion rather than searching for information about the vulnerability.

However, while code scanning autofix can be a helpful tool for , it has limitations that must be considered. urges developers to carefully review the changes and dependencies before accepting them to ensure the security and functionality of the code.

The limitations of the autofix code suggestions include:

  • Suggesting fixes that are not syntactically correct code changes.
  • Suggesting fixes that are syntactically correct code but are suggested in the incorrect location.
  • Suggesting fixes that change the semantics of the program.
  • Suggesting fixes that do not address the root cause or introduce new vulnerabilities.
  • Suggesting fixes that only partially resolve the underlying flaw.
  • Suggesting unsupported or insecure dependencies.

Moreover, the system must have complete knowledge of dependencies published on the broader ecosystem. This could lead to suggestions that add a new dependency on malicious software. Therefore, it is essential to evaluate the suggestions before implementing them.

In conclusion, code scanning autofix is a valuable feature that can be helpful for developers. However, it is crucial to exercise caution while using it to ensure the security and functionality of the code.

Leave a comment

Newsletter Signup

The Grid —
The Matrix Has Me
Big Bear Lake, CA 92315

01010011 01111001 01110011 01110100 01100101 01101101 00100000
01000110 01100001 01101001 01101100 01110101 01110010 01100101

I knew you'd escape. They haven't built a circuit that could hold you!Yori

Deitasoft © 2024. All Rights Reserved.