Disabling Copilot Autofix for code scanning

You can disable Copilot Autofix for an enterprise, organization, or repository.

Who can use this feature?

Agentic Autofix has narrower eligibility requirements than Copilot Autofix, and isn't available for user-owned repositories in an enterprise that uses Enterprise Managed Users. For details, see About autofix for code scanning.

Copilot Autofix for code scanning is available for the following repository types:

  • Public repositories on GitHub.com
  • Organization-owned repositories on GitHub Team with GitHub Code Security enabled

For more information about eligible products, see About GitHub Advanced Security.

In this article

This article covers disabling Copilot Autofix. Agentic Autofix has separate access controls. To disable agentic autofix, see Managing access to agentic autofix for code scanning.

For enterprise-owned organizations, controls for Copilot Autofix follow this hierarchy:

  • Enterprise owners control whether the feature is allowed in the enterprise. When allowed, it can be enabled at lower levels (but is not automatically enabled).
  • When it's enabled by the enterprise, organization owners can still disable it for their organization. This prevents any repository in the organization from enabling it.
  • If both the enterprise and organization have the feature enabled, repository administrators can disable it for the individual repository.

For standalone organizations, the organization and repository controls apply without an enterprise policy.

Disabling Copilot Autofix at any level closes all open suggestions that it added as comments on code scanning alerts in affected pull requests. If you later re-enable it, suggestions are generated only for new pull requests. To generate suggestions for existing pull requests, re-run code scanning security analysis.

Note

Copilot Autofix is an integral part of GitHub Code Quality and will continue to run on code quality results even when it is disabled for code security results.

Blocking use of Copilot Autofix for an enterprise

Enterprise owners can disallow Copilot Autofix for security results across all organizations and repositories in their enterprise.

  1. Navigate to your enterprise. For example, from the Enterprises page on GitHub.com.
  2. At the top of the page, click Policies.
  3. Under "Policies", click Advanced Security.
  4. Under "Copilot Autofix", use the dropdown and select All organizations: Not allowed.

Disabling Copilot Autofix for an organization

Organization owners can disable Copilot Autofix for all repositories in their organization. For enterprise-owned organizations, this setting is only available if the enterprise allows Copilot Autofix.

  1. In the upper-right corner of GitHub, click your profile picture, then click Organizations.

  2. Select an organization by clicking on it.

  3. Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of the tabs in an organization's profile. The "Settings" tab is outlined in dark orange.

  4. In the " Security and quality" section of the sidebar, click Advanced Security then Global settings.

  5. Under the "Code scanning" section, set Copilot Autofix to Off.

Disabling Copilot Autofix for a repository

Repository administrators can disable Copilot Autofix if their organization enables it. For enterprise-owned organizations, this setting is only available if the enterprise also allows Copilot Autofix.

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security and quality" section of the sidebar, click Advanced Security.

  4. In the "Code Security" section, set Copilot Autofix to Off.