Run Copilot security reviews before code leaves your branch

GitHub has added a /security-review slash command to the GitHub Copilot app, extending the security-focused review flow beyond the earlier Copilot CLI preview. Use it as a pre-PR or pre-merge check when a branch includes authentication, file upload, payment, dependency, or permission changes.

What to try:

• Open a project in the Copilot app.
• Make or load the code changes you want reviewed.
• Run /security-review and inspect the findings before you create or merge a pull request.
• Keep normal SAST, dependency scanning, secret scanning, and human review in place.

Limits to remember:

• GitHub labels the app command as public preview.
• Copilot code review availability depends on plan and organization policy.
• AI review can miss issues, especially in framework-specific flows or code paths that need runtime context.
• Treat findings as triage input, not as a release gate by itself.