{"meta":{"title":"Finding existing vulnerabilities in code","intro":"Copilot Chat can help find common vulnerabilities in your code and suggest fixes.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/copilot","title":"GitHub Copilot"},{"href":"/en/copilot/tutorials","title":"Tutorials"},{"href":"/en/copilot/tutorials/copilot-cookbook","title":"GitHub Copilot Cookbook"},{"href":"/en/copilot/tutorials/copilot-cookbook/analyze-security","title":"Analyze security"},{"href":"/en/copilot/tutorials/copilot-cookbook/analyze-security/find-vulnerabilities","title":"Find vulnerabilities"}],"documentType":"article"},"body":"# Finding existing vulnerabilities in code\n\nCopilot Chat can help find common vulnerabilities in your code and suggest fixes.\n\nWhile they may be considered \"common knowledge\" by many developers, the vast majority of newly introduced security weaknesses are due to vulnerabilities like cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF). These vulnerabilities can be mitigated by following secure coding practices, such as using parameterized queries, input validation, and avoiding hard-coded sensitive data. GitHub Copilot can help detect and resolve these issues.\n\n> \\[!NOTE] While Copilot Chat can help find some common security vulnerabilities and help you fix them, you should not rely on Copilot for a comprehensive security analysis. Using code scanning will more thoroughly ensure your code is secure. For more information on setting up code scanning, see [Configuring default setup for code scanning](/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning).\n\n## Example scenario\n\nThe JavaScript code below has a potential XSS vulnerability that could be exploited if the `name` parameter is not properly sanitized before being displayed on the page.\n\n```javascript id=potential-xss\nfunction displayName(name) {\n  const nameElement = document.getElementById('name-display');\n  nameElement.innerHTML = `Showing results for \"${name}\"`\n}\n```\n\n## Example prompt\n\nYou can ask Copilot Chat to analyze code for common security vulnerabilities and provide explanations and fixes for the issues it finds.\n\n```copilot copy prompt ref=potential-xss\nAnalyze this code for potential security vulnerabilities and suggest fixes.\n```\n\n## Example response\n\n> \\[!NOTE] The following response is an example. Copilot Chat responses are non-deterministic, so you may get a different response from the one shown here.\n\nCopilot responds with an explanation of the vulnerability, and suggested changes to the code to fix it.\n\n```javascript\nfunction displayName(name) {\n  const nameElement = document.getElementById('name-display');\n  nameElement.textContent = `Showing results for \"${name}\"`;\n}\n```\n\n## Further reading\n\n* [Prompt engineering for GitHub Copilot Chat](/en/copilot/concepts/prompting/prompt-engineering)\n* [Best practices for using GitHub Copilot](/en/copilot/get-started/best-practices)\n* [Code scanning](/en/code-security/concepts/code-scanning/code-scanning)"}