GitHub shipped the /security-review slash command to its Copilot desktop app on July 14, making AI-driven pre-commit vulnerability scanning available to every Copilot subscriber — including Free tier users — for the first time without requiring a terminal or experimental-mode opt-in, according to the official GitHub Changelog. GitHub Copilot is now the largest single source of AI-generated code in the world, and research from Veracode's 2025 GenAI Code Security Report found that 45% of AI-generated code introduces at least one OWASP vulnerability. When a developer types /security-review in the Copilot app, the command gathers the current workstream diff and submits that context to GitHub's cloud-hosted Copilot model routing infrastructure, which returns a prioritized list of findings scored by severity and confidence. The scan targets five high-impact vulnerability classes: injection flaws, cross-site scripting (XSS), insecure data handling, path traversal, and weak cryptography. The command is not a replacement for GitHub's existing security infrastructure; it does not perform CVE database matching, cross-file taint analysis, or dependency scanning.