What does Copilot cloud agent check by default in the code it generates?
Why B is the answer
Security issues, with a second opinion from Copilot code review
GitHub says it checks for security issues and uses code review, then tries to resolve what it finds. This validation needs no Advanced Security license.
In detail
- It checks for security issues by default.
- Copilot code review gives a second opinion.
- Default checks do not replace your review.
Use case
An illustrative scenario, not a real incident.
Copilot cloud agent's code gets security checks by default, and Copilot code review gives a second opinion before a person looks.
See it in different ways
flowchart LR A["Agent output"] --> B["Tests and code scanning"] A --> C["Reviewer feedback"] B --> D["Evaluation"] C --> D D --> E["Tune the agent"]
sequenceDiagram participant T as Team participant A as Agent participant R as Results T->>T: Set success criteria A->>R: Several runs, across tasks R-->>T: Tests, scans and review signals T->>A: Keep or drop the change
flowchart LR S0["Agent writes code"] --> S1["Security checks"] --> S2["Copilot code review"] --> S3["Human review"]
Key point: Default checks cover security.
Why the other options are wrong
- A. Only whether the file names follow the repository convention
- It checks more than file names.
- C. Only the spelling used in code comments and pull request titles
- It checks more than spelling.
- D. Nothing, because all checks have to be added by an administrator
- Checks are on by default.