{"meta":{"title":"About autofix for code scanning","intro":"Autofix generates potential fixes for code scanning alerts, helping you remediate existing vulnerabilities.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/code-scanning","title":"Code scanning"},{"href":"/en/code-security/concepts/code-scanning/autofix-for-code-scanning","title":"Autofix"}],"documentType":"article"},"body":"# About autofix for code scanning\n\nAutofix generates potential fixes for code scanning alerts, helping you remediate existing vulnerabilities.\n\nGitHub provides two separate autofix experiences for code scanning alerts: agentic autofix and Copilot Autofix. Both use large language models (LLMs), data from the codebase, and code scanning analysis to generate potential code changes and explanations. However, they have different workflows, results, access requirements, and usage.\n\n## What are the two types of autofix?\n\nAgentic Autofix and Copilot Autofix solve different problems:\n\n* Use agentic autofix when you want Copilot to investigate and fix one or more alerts for you, end to end.\n* Use Copilot Autofix when you want a single suggested code change for one alert that you review and apply yourself.\n\nWith agentic autofix, you assign one or more alerts to Copilot. It explores the codebase, generates a fix, and validates the changes. Then it opens a draft pull request containing the proposed fix.\n\nWith Copilot Autofix, GitHub generates a single suggested code change for one supported alert. You can use this suggestion to create a pull request yourself.\n\n## Where is autofix available?\n\nAccess to the two features works differently. For agentic autofix on an organization-owned repository, an organization owner or security manager must enable it. If the organization belongs to an enterprise, an enterprise owner or security manager must also allow it. Organization enablement turns it on for eligible repositories by default, but a repository administrator can opt out, or re-enable it when higher-level settings permit.\n\nFor an eligible public repository owned by a personal account, a repository administrator can enable agentic autofix directly. You don't need a Copilot license to use agentic autofix, but it isn't available for repositories owned by Enterprise Managed Users. See [Managing access to agentic autofix for code scanning](/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/managing-access-to-agentic-autofix-for-code-scanning) for details.\n\nCopilot Autofix, by contrast, is enabled by default for any repository that uses CodeQL, unless an administrator disables it. It's available to all public repositories on GitHub.com. It's also available to internal or private repositories owned by organizations and enterprises that have a license for GitHub Code Security. Unlike agentic autofix, Copilot Autofix is available for repositories owned by Enterprise Managed Users.\n\n## Choosing an autofix type\n\nUsage costs also factor into which feature to use. Each agentic autofix agent session consumes AI credits and GitHub Actions minutes, while Copilot Autofix suggested fixes don't consume AI credits.\n\nIf agentic autofix isn't enabled for a repository, you can still use Copilot Autofix to generate suggested fixes for supported alerts.\n\n## Using agentic autofix\n\nUse agentic autofix when you want Copilot to investigate one or more alerts and prepare a draft pull request. You can assign agentic autofix alerts from the repository backlog or a security campaign. Each assignment starts an agent session. The session explores the codebase beyond the affected file, then generates and validates a fix. It opens a pull request with the changes. See [Resolving code scanning alerts](/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#fixing-alerts-with-copilot).\n\nKeep the following in mind:\n\n* For details on enabling agentic autofix at the organization, enterprise, or repository level, see [Managing access to agentic autofix for code scanning](/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/managing-access-to-agentic-autofix-for-code-scanning).\n* Agentic Autofix consumes Code Security AI Credits and GitHub Actions minutes. See [GitHub Advanced Security license billing](/en/billing/concepts/product-billing/github-advanced-security#how-ai-feature-usage-is-billed).\n* Copilot uses the custom instructions that apply when it generates a fix. See [Add custom instructions for Copilot](/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions).\n* Agentic Autofix works on a best-effort basis. Copilot validates fixes by re-running CodeQL with the code scanning query suite. It can't confirm fixes for alerts from custom CodeQL queries, the `security-extended` CodeQL query suite, or code scanning alerts from third-party tools.\n\nAlways review and test the generated changes before you merge the pull request.\n\n## Using Copilot Autofix\n\nCopilot Autofix works the same way whether a repository uses default or advanced setup for code scanning. There is no separate step to enable it: enabling code scanning with CodeQL is sufficient. See [Configuring default setup for code scanning](/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning).\n\nCopilot Autofix is also an integral part of GitHub Code Quality, and continues to run on code quality results even when it's disabled for code scanning results.\n\nAdministrators at the enterprise, organization, and repository levels can disable Copilot Autofix. Settings cascade downward: if an enterprise owner disallows the feature, no organization or repository in that enterprise can enable it, and if an organization owner disables it, no repository in that organization can re-enable it. To restore the feature at a given level, an administrator at that level, or a level above, must reverse the setting. To learn how to manage Copilot Autofix at each level, see [Disabling Copilot Autofix for code scanning](/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-copilot-autofix-for-code-scanning)."}