Fixing alerts in a security campaign

Viewing alerts in a security campaign

When a campaign targets security alerts in a repository that you have write access to, you can navigate to the list of repository alerts in the campaign.

• Display the Security and quality tab for the repository and click one of the campaigns under "Campaigns" in the sidebar.
• If you have write access to more than one repository in the organization, display the Security and quality tab for the organization and click one of the campaigns under "Campaigns" in the sidebar.
• Alternatively, click View security campaign in the campaign's email notification.

This view shows the alerts in the current repository for a campaign called "SQL injection (CWE-89)" (highlighted gray) that is managed by "octocat" (outlined in dark orange).

Fixing alerts in a security campaign

If you want to see the code that triggered the security alert and the suggested fix, click on the alert name to show the alert view.

If agentic autofix is enabled, the fastest way to resolve alerts is to assign them to Copilot. Agentic Autofix explores the codebase, generates and validates a fix, and opens a pull request. See Assigning alerts to Copilot below. The following steps describe how to fix alerts yourself instead.

1. When you are ready to work on one or more security alerts, check whether they are already assigned to Copilot or whether someone else is working on them. Open any linked work to check whether a fix is already in progress:

   • an open draft pull request may fix this alert.
   • an open pull request may fix this alert.
   • a branch may contain changes to fix this alert.

2. In the campaign view for the repository, select the alerts that you want to fix.

3. Connect the security alerts to a working branch:

   • If at least one "Autofix" suggestion is available for the selected alerts, click Commit autofix and commit the changes either to a new branch or to an existing branch.
   • If no autofix suggestions are available for the selected alerts, click Create new branch to create a new branch where you will work on fixing the alerts.

4. When you have finished fixing the alerts and testing your solutions, create a pull request for your changes and request a review from the campaign manager.

Assigning alerts to Copilot

Before you assign alerts, agentic autofix must be enabled for the repository. See Managing access to agentic autofix for code scanning.

Agentic Autofix consumes AI credits and GitHub Actions minutes.

You can assign between 1 and 25 alerts from the campaign view. One assignment creates one agent session and one pull request for the selected alerts. It also adds you as a requested reviewer.

1. In the repository's campaign view, select the alerts that you want to assign.
2. Above the list of alerts, click Assign to Copilot.

Typically within a few minutes, Copilot opens a pull request that addresses the assigned alerts. The pull request summarizes the fixes and changes, and appears next to each assigned alert.

For more information about reviewing the session and pull request, see Resolving code scanning alerts.

Using GitHub Copilot Chat for secure coding

If you have access to Copilot Chat then you can ask the AI questions about the vulnerability, the suggested fix, and how to test that the fix is comprehensive.