GitHub Adds API Control for AI Security Scans

GitHub has introduced a public preview of new API endpoints that allow developers to manage AI-powered security scans for pull requests. This update provides a programmatic method for organizations to enable or disable these automated checks across their repositories without navigating through the user interface.

The feature is designed to streamline the rollout of security measures for teams managing large numbers of code repositories. By treating security settings as code, engineering teams can integrate these controls directly into their deployment pipelines, ensuring that AI detection tools are active exactly where needed.

Managing security settings via code

According to a report from GN technics/ai (en-US), the new endpoints allow users to read and update the status of AI Scan at both the organization and individual repository levels. This means administrators can set a default security posture for the entire organization while also allowing specific teams to opt in or out of scanning for particular projects.

However, there is a strict hierarchy in how these settings apply. If an organization admin disables AI Scan at the top level, individual repositories cannot override that decision to turn it back on. This ensures that central security policies remain authoritative, preventing accidental gaps in coverage that might occur if local settings were allowed to conflict with global rules.

Availability and platform limitations

The public preview is currently available only on the github.com platform and requires a GitHub Advanced Security subscription. This restricts access to organizations that have already paid for advanced security features, meaning smaller teams or those using the free tier will not have immediate access to these new management tools.

Additionally, GitHub Enterprise Server, which allows companies to host their own instances of GitHub on private infrastructure, does not support this release. For organizations relying on on-premise solutions, this creates a trade-off: they must continue to manage these AI scan settings manually through the interface until a future update includes this capability for self-hosted environments.

Benefits for large engineering teams

The primary benefit of this change is efficiency. For large engineering organizations with hundreds or thousands of repositories, manually toggling security settings in a graphical interface is time-consuming and prone to human error. The API approach allows these settings to be versioned and audited alongside the code itself, creating a clear record of when and where security controls were changed.

This shift also supports a broader trend in software development where infrastructure and configuration are managed through code. By making AI security scans part of this workflow, GitHub is helping teams standardize their security practices. While the feature is still in preview, it signals a move toward more automated and integrated security management for modern development environments.