Why Application Security Belongs in the Developer Workflow

▶ Watch (02:00)

Fixing a vulnerability means editing code. The only people who can do that are developers, which is why GitHub frames application security as a developer problem, not a security team problem. Since 2020, GitHub has shipped supply chain tools (Dependabot), secret protection, artifact attestations, and CodeQL-based SAST, all wired into the repository so findings land where developers already work.

The logic is straightforward: security teams can set policy, but they cannot merge PRs. Getting risk numbers to move requires pulling developers in, not routing findings to a separate dashboard they’ll rarely open.

CodeQL Engine Improvements: Coverage, Build-Less Setup, and Speed

▶ Watch (06:48)

CodeQL now runs over 600 security checks, added Rust in general availability, and scans GitHub Actions workflows for injection or missing permissions. The bigger change is build-less setup for compiled languages. Java, C++, and C# previously required manual workflow files and weeks of rollout. One-click enabling now handles the build step automatically, pushing C# onboarding rates up 15x per month. Customers like Tellus moved from weeks to minutes to cover an entire portfolio.

“we have saved developers more than 2 million actions minutes per month due to our performance improvements” — Pierre Tempel

Incremental scanning averages 20% faster (40% on GitHub’s own 3.5-million-line Ruby monorepo). The 2026 target is 10x.

Copilot Auto Fix: From Finding to Merged Fix in One Pull Request

▶ Watch (13:17)

Auto fix generates remediation suggestions for nearly all vulnerability types CodeQL detects, posted directly into the pull request. The fix includes a plain-language plan, multifile code edits, dependency updates, and an advisory database check to confirm the new dependency has no known CVEs. Pierre walked through the Copilot auto fix live demo (14:01): a reflected XSS bug, the sanitization fix and package.json update, then CodeQL rerunning deterministically to verify every data flow path resolved.

“Developers on github.com have fixed more than 100,000 security issues with Copilot auto fix, and we know those are real fixes.” — Pierre Tempel

At Bayer, that translated to 20,000 security issues cleared and mean time to remediation down 70% in six months.

Coding Agent Secured by Default

▶ Watch (17:07)

GitHub’s Coding agent now runs CodeQL on every PR it opens, checks the advisory database before adding any dependency, and uses secret protection to block API keys or credentials from reaching the repo. If CodeQL flags an issue, the agent fixes it and reruns the scan before considering the task done. Pierre showed the Coding agent session log demo (17:54): the agent wrote an actions workflow, ran CodeQL, added an explicit permissions block, and verified the finding was cleared.

This is available free to all Coding agent users, regardless of whether code security or advanced security is enabled.

Security Campaigns and Clearing Existing Debt at Enterprise Scale

▶ Watch (20:14)

90% of security debt remains unresolved. Security campaigns give security teams a focused sprint mechanism: pick a vulnerability class (SQL injection, XSS), push the relevant findings and their auto fixes to developers as GitHub Issues, and track progress. In the first month, tens of thousands of findings were prioritized in campaigns and over two-thirds were remediated.

GitHub announced at Universe that Coding agent now integrates with campaigns. Bas showed the Security campaign Coding agent assignment demo (24:06): 18 alerts across multiple repositories, assigned to the agent, which opened PRs, handled CI failures, and finished the fixes.

Notable Quotes

90% of security debt remains unresolved. Bas van Schaik · ▶ 20:46

we have saved developers more than 2 million actions minutes per month due to our performance improvements Pierre Tempel · ▶ 12:48

Developers on github.com have fixed more than 100,000 security issues with Copilot auto fix, and we know those are real fixes. Pierre Tempel · ▶ 16:25

Key Takeaways

  • CodeQL’s build-less setup enables 10x more repositories per month for compiled languages like C# and Java.
  • Copilot auto fix cut mean time to remediation by 70% at Bayer and saved 1.5 million developer hours in six months.
  • Security campaigns achieve a 68% remediation rate on prioritized debt; Coding agent integration now handles fixes automatically.