Signal, not noise: five primary-source reads from September 16, each with a two-line note on why it matters for builders.
Copilot budget increase requests are generally available
Members who exhaust their Copilot credits can now request a bigger budget at the moment they hit the limit, and owners approve, adjust, or deny without leaving settings. If agents share your seats, set a top-up routine now so a midnight run does not stall on an empty meter.
Read the full story at GitHub Changelog (September 16, 2026).
Migrating the GitHub Copilot runtime to Rust, using Copilot
GitHub rewrote its Copilot agent runtime from TypeScript into more than 800,000 lines of production Rust, with agents writing most of the code across 128 pull requests shipped incrementally. Treat it as proof that a small crew plus agents can carry a rewrite once owned, and keep your own harness seams narrow enough to port.
Read the full story at GitHub Blog (September 16, 2026).
Code scanning AI Scan no longer requires CodeQL default setup
AI Scan for pull requests now finds vulnerabilities even on repositories without CodeQL default setup, as long as scanning and AI Scan are enabled. Flip it on for one legacy repository first and compare the findings against your current checks before rolling it out widely.
Read the full story at GitHub Changelog (September 16, 2026).
When scanners miss the attack: how Client-Side Security protects storefronts
Cloudflare pairs a graph model that flags under 0.3 percent of scripts with a Workers AI second opinion and a cohort of frontier models acting as judges with a restricted evaluator. If you run a storefront, monitor third-party scripts continuously instead of trusting a one-time scan before launch.
Read the full story at Cloudflare Blog (September 16, 2026).
Automate SSO authorization for classic PATs and SSH keys
Enterprise admins can now bulk-authorize a classic token or SSH key for up to 50 organizations in one request through a GitHub App, identified by token ID or fingerprint so no secrets change hands. Use it to make rotation cheap again instead of clinging to long-lived tokens across many organizations.
Read the full story at GitHub Changelog (September 16, 2026).