Disabling Copilot Autofix for code scanning

You can disable Copilot Autofix for an enterprise, organization, or repository.

This article covers disabling Copilot Autofix. Agentic Autofix has separate access controls. To disable agentic autofix, see Managing access to agentic autofix for code scanning.

For enterprise-owned organizations, controls for Copilot Autofix follow this hierarchy:

• Enterprise owners control whether the feature is allowed in the enterprise. When allowed, it can be enabled at lower levels (but is not automatically enabled).
• When it's enabled by the enterprise, organization owners can still disable it for their organization. This prevents any repository in the organization from enabling it.
• If both the enterprise and organization have the feature enabled, repository administrators can disable it for the individual repository.

For standalone organizations, the organization and repository controls apply without an enterprise policy.

Disabling Copilot Autofix at any level closes all open suggestions that it added as comments on code scanning alerts in affected pull requests. If you later re-enable it, suggestions are generated only for new pull requests. To generate suggestions for existing pull requests, re-run code scanning security analysis.

Blocking use of Copilot Autofix for an enterprise

Enterprise owners can disallow Copilot Autofix for security results across all organizations and repositories in their enterprise.

1. Navigate to your enterprise. For example, from the Enterprises page on GitHub.com.
2. At the top of the page, click Policies.
3. Under "Policies", click Advanced Security.
4. Under "Copilot Autofix", use the dropdown and select All organizations: Not allowed.

Disabling Copilot Autofix for an organization

Organization owners can disable Copilot Autofix for all repositories in their organization. For enterprise-owned organizations, this setting is only available if the enterprise allows Copilot Autofix.

1. In the upper-right corner of GitHub, click your profile picture, then click Organizations.

2. Select an organization by clicking on it.

3. Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

   

4. In the " Security and quality" section of the sidebar, click Advanced Security then Global settings.

5. Under the "Code scanning" section, set Copilot Autofix to Off.

Disabling Copilot Autofix for a repository

Repository administrators can disable Copilot Autofix if their organization enables it. For enterprise-owned organizations, this setting is only available if the enterprise also allows Copilot Autofix.

1. On GitHub, navigate to the main page of the repository.

2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

   

3. In the "Security and quality" section of the sidebar, click Advanced Security.

4. In the "Code Security" section, set Copilot Autofix to Off.