GitHub Copilot's paid plans cover assisted code review on pull requests and chat inside your editor, all drawn from a monthly pool of AI credits. They do not replace dependency inventory, secrets history scans or policy gates. Treat Copilot as a reviewer in the loop, then check what still needs a separate control.
Prices and limits below come from GitHub's own documentation, fetched on 18 October 2026. They change, so confirm on the page before you budget.
What do the plans cost today?
GitHub's plans page lists these monthly prices in USD: Copilot Pro at $10, Pro+ at $39 and Max at $100 for individuals. Copilot Business is $19 per granted seat and Enterprise is $39 per granted seat. Free and Student plans exist with a smaller allowance.
Usage is metered in GitHub AI Credits. The page lists base credits of 1,000 for Pro, 3,900 for Pro+ and 10,000 for Max, and 1,900 and 3,900 per user for Business and Enterprise. For organizations, usage beyond the shared pool is charged at $0.01 per AI credit. Code completions and next edit suggestions are not billed in credits on paid plans.
We say nothing here about what any of this costs GitHub to run. Only the published numbers count.
Which security tasks does a seat cover?
Copilot code review is documented as available for all paid Copilot plans. It reads a pull request, flags issues and offers fixes you can apply. The docs describe review effort levels. The Lite level gives fast feedback on common issues including security vulnerabilities. The default Balanced level routes to a higher-reasoning model for security-sensitive code and multi-service changes, and it uses more AI credits.
Chat, inline chat and slash commands in the IDE are in every plan, so a developer can ask "is this query safe?" while writing it. That is useful and it is also advice from a model, not a scan result.
Content exclusion, which keeps chosen files out of Copilot, is listed among the features for the organization plans. That matters if some repositories hold regulated data.
What sits outside the plan?
Three things are worth separating.
First, Copilot Autofix for code scanning. GitHub's application card says it generates fix suggestions for CodeQL alerts and does not require a Copilot subscription. It needs code scanning to be running. So the fixer is tied to the scanner, not to the seat.
Second, rules-based analysis. The code review docs point to GitHub Code Quality as the complement, adding CodeQL-powered analysis on pull requests and the default branch. That is a separate product.
Third, everything that has nothing to do with a pull request diff: a full inventory of transitive dependencies, license risk, secrets in git history, container images, and evidence for an auditor. A reviewer that reads a diff cannot see a vulnerable package three levels down that nobody touched this week.
How should a team decide?
Start from the failure you want to prevent. If it is a logic bug or an unsafe pattern slipping into a pull request, a model reviewer helps. If it is a known vulnerable dependency reaching production, you need a scanner that reads lockfiles and matches advisories. If it is a leaked key, you need pattern and history scanning.
Be careful with a model reviewer as your only gate. It can be wrong in both directions, and its output can change between runs. Scanners produce repeatable results you can show an auditor.
What to do
- Write down the three security failures you most want to stop, with one past example of each.
- Map each one to a control: model review, deterministic scanner, secrets scan or policy gate.
- Check GitHub's plans page and the code review page for your plan today, and record the date.
- Estimate credit use from your pull request volume, using Balanced review only on sensitive repositories.
- Turn on code scanning separately if you want Autofix, and confirm its licensing for your repository type.
- Keep one deterministic gate in CI so a missed model suggestion does not become a release.
- Revisit in a quarter, since plan terms have shifted more than once.
Quick check
Does Copilot Autofix need a Copilot subscription?
According to GitHub's application card, no. It is available for CodeQL analysis and does not require a Copilot subscription, though code scanning must be set up.
Is Copilot code review included in the free plan?
The code review page says it is available for all paid plans. The plans table shows a limited form for free users, so check the current table for what applies to you.
Sources
- Plans for GitHub Copilot, GitHub Docs, fetched 18 October 2026
- GitHub Copilot code review, GitHub Docs, fetched 18 October 2026
- About Copilot Autofix and GitHub Code Security AI features, GitHub Docs, fetched 18 October 2026
Last reviewed: 18 October 2026.
