Security Scanning Moves Left—All the Way to Your Editor

GitHub shipped secret scanning via the GitHub MCP Server to general availability this week, and it's the kind of shift-left move I've been waiting for. You can now ask Copilot to scan your uncommitted changes for exposed credentials directly in VS Code or Copilot CLI—before you commit, before you open a PR, before anyone has to file a post-incident report about leaked AWS keys.

This isn't a new scanning engine. It's the same GitHub Secret Scanning that's been catching credentials in repositories for years, now wired into the Model Context Protocol so AI agents can invoke it as a tool.…