Summary
GitHub added a /security-review slash command to the Copilot app in public preview that analyzes current workstream changes and returns severity- and confidence-scored security findings with actionable, reverifiable fixes, available to Free, Pro, Business, and Enterprise users.
What changed
On July 14, 2026, GitHub launched the /security-review command in public preview in the Copilot app. It scans a developer's current changes for high-impact vulnerability classes such as injection, cross-site scripting, insecure data handling, path traversal, and weak cryptography, then returns high-confidence findings scored by severity and confidence plus suggestions the developer can apply and reverify without leaving Copilot.
Why it matters
Pushing security review into the agent-native Copilot app moves vulnerability detection left, to the moment code is written rather than at PR or CI time. Bundling scored findings with in-place, reverifiable fixes turns the assistant into a security reviewer, intensifying competition with dedicated AppSec and code-scanning tools.
Evidence excerpt
The /security-review command analyses your current workstream changes and returns: High-confidence security findings, scored by severity and confidence. Actionable suggestions you can apply and reverify without leaving Copilot. Available to Copilot Free, Pro, Business, and Enterprise users during public preview.