{"meta":{"title":"About autofix for code scanning","intro":"Autofix automatically generates fixes for code scanning alerts, helping you remediate existing vulnerabilities.","product":"Security and code quality","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/code-security","title":"Security and code quality"},{"href":"/en/enterprise-cloud@latest/code-security/concepts","title":"Concepts"},{"href":"/en/enterprise-cloud@latest/code-security/concepts/code-scanning","title":"Code scanning"},{"href":"/en/enterprise-cloud@latest/code-security/concepts/code-scanning/autofix-for-code-scanning","title":"Autofix"}],"documentType":"article"},"body":"# About autofix for code scanning\n\nAutofix automatically generates fixes for code scanning alerts, helping you remediate existing vulnerabilities.\n\nAutofix provides you with targeted recommendations to help you fix code scanning alerts so you can avoid introducing new security vulnerabilities. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase and from code scanning analysis.\n\n## How autofix works\n\nAutofix translates the description and location of a code scanning alert into code changes that may fix it. It interfaces with the large language model GPT-5.3-Codex from OpenAI, which has sufficient generative capabilities to produce both suggested fixes in code and explanatory text for those fixes.\n\nThere are two ways to get a fix for an alert: agentic autofix and Copilot Autofix. If Copilot cloud agent is available in a repository, assigning an alert uses agentic autofix instead of Copilot Autofix.\n\n## Agentic autofix\n\n> \\[!NOTE] This feature is currently in public preview and is subject to change.\n\nAssign a code scanning alert to Copilot to have it resolve the alert for you. Assigning an alert starts an agent session: Copilot cloud agent calls tools to explore your codebase beyond the affected file, generates a fix, validates it (for example, by re-running CodeQL), and iterates until it opens a pull request with the changes. See [Resolving code scanning alerts](/en/enterprise-cloud@latest/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#fixing-alerts-with-copilot).\n\nKeep the following in mind:\n\n* Agentic autofix requires Copilot cloud agent and Copilot Autofix to be available in the repository. If Copilot cloud agent isn't available, assigning an alert falls back to Copilot Autofix instead.\n* Each agentic autofix session is billed as a Copilot cloud agent session and consumes AI credits. See [About GitHub Copilot cloud agent](/en/enterprise-cloud@latest/copilot/concepts/agents/cloud-agent/about-cloud-agent#copilot-cloud-agent-usage-costs).\n* Copilot follows any custom instructions configured for the repository or organization when it generates a fix.\n* Agentic autofix works on a best-effort basis. Copilot validates fixes by re-running CodeQL using the code-scanning query suite, so it can't confirm that a fix resolves alerts generated by custom queries or the security-extended query suite. Fix quality for alerts from third-party tools is also not guaranteed.\n\n## Getting a suggested fix with Copilot Autofix\n\nCopilot Autofix generates a single suggested fix for an alert, which you review and apply yourself.\n\nYou do not need a subscription to GitHub Copilot to use GitHub Copilot Autofix, and it does not consume AI credits. Copilot Autofix is available to all public repositories on GitHub.com, as well as internal or private repositories owned by organizations and enterprises that have a license for GitHub Code Security.\n\nCopilot Autofix is allowed by default and enabled for every repository that uses CodeQL, regardless of whether it uses default or advanced setup for code scanning. There is no separate step to enable Copilot Autofix: enabling code scanning with CodeQL is sufficient. See [Configuring default setup for code scanning](/en/enterprise-cloud@latest/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning).\n\nAdministrators at the enterprise, organization, and repository levels can choose to disable Copilot Autofix. If Copilot Autofix has been disabled at your level, you can re-enable it by following the same steps used to disable it and selecting the option to allow Copilot Autofix. To learn how to manage Copilot Autofix at each level, see [Disabling autofix for code scanning security alerts](/en/enterprise-cloud@latest/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning)."}