GitHub AI Scan checks your whole repo for security holes, but not private personal repos
Ship ItChecked against the official source
Source checked 2 Nov 2026 · Published 2 Nov 2026 · Last reviewed 2 Nov 2026 · By Ctrl+Z Therapy (how we test)
The short answer
GitHub's changelog of October 28, 2026: AI Scan for repositories is in public preview. It finds vulnerabilities across your whole repository, not just in pull request changes, and each scan analyzes the latest commit on the default branch. For repositories owned by personal accounts, it's available for public repositories only: private repositories owned by personal accounts aren't supported.
What to do
- For a public repository on your personal account, turn on AI Scan in repository settings.
- Start a scan from the Code scanning page. Findings appear in your code scanning alert list.
- After you merge a fix, start a new scan: AI Scan alerts don't automatically close when you merge a fix.
Good to know
- AI Scan for repositories consumes Code Security AI credits. For public repositories owned by a personal account, usage is billed to that personal account. If you've used up your budget, GitHub tells you before a scan starts.
- A GitHub Copilot license isn't required.
- Organization-owned private repositories need GitHub Code Security or GitHub Advanced Security.
Source
Checked on 2 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.