GitHub removes a setup barrier for AI Scan in pull requests
GitHub's AI Scan can now look for security vulnerabilities in pull requests even when CodeQL default setup is not enabled on the repository.
What changed
GitHub says AI Scan for pull requests no longer depends on CodeQL default setup being enabled first. Code scanning and AI Scan still need to be enabled at the relevant repository, organization or enterprise level. The change is in public preview for eligible GitHub Advanced Security customers on github.com, while GitHub Enterprise Server is not supported for this release.
Why it matters
For engineering and security teams, setup friction can determine whether a security control is used consistently. Removing the CodeQL prerequisite makes AI Scan easier to trial on repositories where a full CodeQL configuration has not been adopted, and can bring vulnerability feedback closer to the pull request workflow.
Buyer takeaway
This makes GitHub's application security stack easier to evaluate incrementally, but buyers should not treat AI Scan as a replacement for a broader code security programme. The practical questions remain coverage, false positive rates, developer workflow impact, licensing and how AI Scan complements existing static analysis and review controls.