GitHub Makes AI Scan Generally Available for PHP Pull Requests

Following a public preview, GitHub made AI Scan for pull requests generally available on 15 October 2026, extending AI-based security detection to PHP and other technologies that CodeQL does not currently cover. The GitHub announcement says the feature analyses eligible pull-request changes and displays potential vulnerabilities alongside existing code-scanning results.

The addition of PHP is relevant to Drupal developers reviewing custom applications, modules and integrations in GitHub repositories. Drupal.org, however, uses GitLab-based issue forks and merge requests for core and contributed-project development. GitHub AI Scan does not operate on that platform, so the new capability should not be described as a security check for Drupal.org contributions.

AI Scan runs when repository code scanning and the applicable AI Scan setting are enabled, and a qualifying pull request contains changes in a supported language or framework. Scans occur when a pull request is opened and after new commits. The feature does not require CodeQL default setup, a separate build configuration or a successful CodeQL run. Other supported technologies include Shell/Bash, Terraform configuration, Dockerfiles, JavaServer Pages and Blazor for C#.

Findings appear in the Conversation and Files changed tabs with an AI indicator to distinguish them from CodeQL alerts. They describe the potential risk, and most include a suggested remediation; Copilot Autofix can provide a proposed code change where available. GitHub's technical documentation lists detection categories such as injection, broken access control, authentication failures, sensitive-data exposure and server-side request forgery. These are areas the scanner attempts to cover, not evidence that it reliably detects Drupal-specific vulnerabilities.

The feature examines pull-request changes rather than conducting full-repository scans, and its findings do not become backlog alerts in the repository's security view. The alerts are advisory: they do not fail the code-scanning check and cannot be used in rulesets to block merges. AI Scan also excludes pull requests from forks and pull requests created by Dependabot. The fork restriction is particularly relevant to open-source maintenance, where external contributions commonly arrive through fork-based workflows.

Availability depends on repository ownership and visibility. Public repositories owned by organisations or personal accounts are eligible, while private and internal organisation-owned repositories require GitHub Code Security or GitHub Advanced Security. Private repositories owned by personal accounts are not eligible, and a GitHub Copilot licence is not required. Repository administrators must also account for the organisation's effective AI Scan settings.

Although public repositories can use the feature without an active-committer security licence, AI Scan still consumes Code Security AI Credits. Included credits may be applied first where a billing account qualifies; further usage is metered and subject to budget controls. GitHub says a hard budget that leaves no available credits prevents the scanner from producing findings until funding becomes available again. Administrators enabling scanning across an organisation should therefore review credit allowances and budgets beforehand.

For Drupal agencies and teams hosting PHP work on GitHub, AI Scan adds a potential security-review signal before changes are merged. Its advisory status, exclusion of fork-originated pull requests and possible false positives mean maintainers still need manual review and other security checks. GitHub has not provided Drupal-specific detection results, so any claim that the feature catches vulnerabilities earlier in Drupal code would require practical evaluation. Further configuration and billing details are available in GitHub's AI Scan documentation.