If you've been assigned alerts as part of a security campaign, this guide explains what campaigns are, what to expect, and how to resolve alerts effectively.
A code security campaign is a focused effort to remediate a defined group of code scanning alerts across one or more repositories.
Campaigns are created by organization owners or security managers and typically target alerts detected in the default branches of repositories. If you’re participating in a campaign, you’ve been asked to help resolve some of these alerts.
In addition to reducing risk in your organization’s codebase, alerts in a security campaign have several other benefits compared with fixing another alert in your repository.
Participating in a campaign helps reduce risk in your organization’s codebase while strengthening your secure coding skills.
Start by reviewing campaign updates and deadlines so you can plan your work effectively.
You'll automatically receive email updates about security campaigns for any repositories you have write access to, so you can stay informed about relevant updates.
In addition, you will receive a notification if someone assigns a code scanning or a secret scanning alert to you. See Assigning alerts.
When you open the Security and quality tab for a repository with one or more campaign alerts, you can see the campaign name in the sidebar of the view. Click the campaign name to see the list of alerts included in the campaign and summary information on how the campaign is progressing.
Some campaigns automatically create GitHub Issues for each repository that detail the campaign managers, contact URL, and due date.
Use this issue to coordinate work, track progress, and keep stakeholders aligned. For example, you might use the issue to:
Your security team may provide you with specific training ahead of participating in a campaign, so that you feel equipped to address the alerts included in the campaign.
If no formal training program is available, you can request that the campaign manager shares information on:
In addition, there are external resources for understanding common security issues:
A security campaign will generally include a contact URL, which might link you to the campaign manager, an open forum (such as a GitHub Discussion), or a website of resources. You should use this space to ask questions about the campaign or specific alerts, find useful resources, and share knowledge.
To find the contact URL:
Tackle similar alerts together to build momentum, reduce context switching, and develop a deeper understanding of the underlying issue. As you gain confidence and efficiency in resolving a specific type of alert, it makes it easier and faster for you to resolve subsequent alerts.
You can leverage Copilot to help resolve alerts in a security campaign. Depending on the features enabled in your repository, you may have access to Copilot Autofix suggestions and Copilot Chat.
If agentic autofix is enabled, you can assign up to 25 alerts from the campaign view to Copilot. One assignment starts one agent session and opens one pull request for the selected alerts. See Fixing alerts in a security campaign.
If agentic autofix isn't enabled, use a Copilot Autofix suggestion where available, or fix the alert manually. After you commit the fix, verify that continuous integration checks still pass. See Fixing alerts in a security campaign.
You can ask Copilot Chat for help in understanding the vulnerability, the suggested fix, and how to test that the fix is comprehensive. To access Copilot Chat, navigate to https://github.com/copilot.
Alternatively, when viewing a specific alert, in the top right corner of the page, click the Copilot Chat icon () to open a chat window, and ask Copilot questions about the alert.
For example:
Explain how this alert introduces a vulnerability into the code.
If you don't already have access to Copilot Chat through your organization, you can sign up to GitHub Copilot Free. See Getting started with a GitHub Copilot plan.