GitHub suggests fixes for CodeQL code scanning alerts on public repositories at no cost, on by default for alerts in pull requests.

What this evidence bears on

• Supports: Platforms already do part of this: since July 2026 OSS-Fuzz attaches tested AI patches to memory-safety bugs it finds in C/C++ projects, and GitHub suggests fixes for code scanning alerts on public repositories for free.

  • A reason for “Keep the deadline, and have platforms scan and patch by default”