// sixthwall for GitHub Copilot

Security scanning for GitHub Copilot projects

Copilot suggests the next line, and the next line is often the one that hardcodes the key or skips the auth check. SixthWall catches those patterns before they are committed and explains each one in plain English.

Three steps

  1. 01

    Run init in your project

    Installs the pre-commit hook and a GitHub Actions workflow, so the same scan runs locally and on every push.

    npx @sixthwall/cli init
  2. 02

    Scan before you commit

    The hook runs automatically. To scan by hand, run the scanner on staged changes.

    npx @sixthwall/cli scan --staged
  3. 03

    Fix with Copilot Chat

    Paste the finding's prompt into Copilot Chat in VS Code to have it make the change.

What it looks for

The same rules run for every project, whatever tool wrote the code. These are the most serious ones. See all rules.

Questions

Does my code leave my machine?

No. The scanner runs locally, makes no network calls during a scan and needs no account. The only download is the scanner itself.

Is it free?

Yes. The editor scanner, the Claude Code integration, the pre-commit hook and the GitHub Action are free with no limits.