🔍 Code Scanning

In one sentence

Default setup vs Advanced setup

There are two ways to enable CodeQL. Default setup is enough to start.

🔑 Unless you have a monorepo, special build requirements, or need custom queries, Default setup is best practice. You can switch to Advanced later.

📘 Details: Configuring default setup ↗

Vulnerabilities CodeQL detects

CodeQL converts code into “queryable data” before analyzing it, so it understands semantics rather than just matching patterns like grep-based SAST.

• 🐛 Injection — SQL injection / Command injection / Path traversal / XSS / SSRF
• 🔓 Auth & authorization — Hardcoded credentials, weak cryptographic algorithms, weak random
• 💣 Memory safety (C/C++) — Buffer overflow / use after free / null dereference
• 🧩 Data flow tracking — Tracks whether user input (taint source) reaches a dangerous function (sink)
• 🌐 Supported languages — C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift

🔬 CodeQL queries are open-sourced at github/codeql. You can write and extend with your own custom queries.

Copilot Autofix — AI fixes it for you ★

The killer feature of Code Scanning. When CodeQL raises an alert, AI generates a fix that you can commit directly to the PR.

• 🤖 How it works — The alert is passed to an LLM (GPT-4 family), which generates a diff based on the relevant code + surrounding context + CodeQL’s description
• 💬 Shown in the PR — “Generate fix” button → review the proposed patch → commit as-is
• ⚡ Reduces MTTR — GitHub internal data shows fix time is 3–4× faster
• 🌐 Coverage — JavaScript/TypeScript, Python, Java/Kotlin, C#, and other CodeQL-supported languages
• 🆓 Free for OSS — Copilot Autofix on public repos has been completely free since 2024 (no Copilot subscription required)

💡 Not just “find vulnerabilities” — “let AI fix them too” is the new standard. Review burden drops dramatically.

📘 Details: About Copilot Autofix ↗

Getting started (fastest path)

Step 1 — Enable Default setup (this alone is enough)

Repo → Settings → Code security → Code scanning
  → Set up CodeQL → Default

GitHub auto-detects your language and generates a CodeQL workflow behind the scenes. Runs automatically on push and PR — results appear in the Security tab + inline comments on the PR’s Files Changed tab.

Step 2 — Enable Copilot Autofix

Enable Copilot Autofix inside Code scanning settings. A “Generate fix” button will appear on alert pages.

Step 3 — Migrate to Advanced setup (if needed)

# .github/workflows/codeql.yml
name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [{ cron: '30 5 * * 1' }]
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions: { security-events: write, contents: read }
    strategy:
      matrix: { language: [javascript, python] }
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
      - uses: github/codeql-action/analyze@v3

Step 4 — Integrate third-party SAST tools (SARIF)

Tools like Semgrep, ESLint security, and Snyk can upload results in SARIF format to appear alongside CodeQL in the Security tab.

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Step 5 — Enable org-wide / enterprise-wide

Use Org → Settings → Code security → default settings to apply to new and existing repos at once. Security campaigns let you manage goals like “fix all critical alerts across all repos within 30 days” (Code Security).

Eligibility and pricing

💰 In 2025, GHAS was split — if you only need code scanning, GitHub Code Security ($30/month/active committer) is enough (no full GHAS contract required). Combine with Secret Protection if you also want secret scanning.
🆓 Public repos get CodeQL and Autofix completely free. If you’re OSS, there’s no reason not to enable this right now.
⚙️ Code scanning workflows run on GitHub-hosted runners — free for public repos; included in GHAS/Code Security for private repos (no additional Actions charges).

📘 Details:

• Introducing GitHub Secret Protection & Code Security (2025 Mar) ↗
• SARIF support for code scanning ↗
• Org default security settings ↗

Code Security Risk Assessment (free inventory scan)

• 🔎 Scope — selects up to 20 repos with the most recent active commits in the org (you can re-select each time)
• 📊 Output — aggregated report of vulnerabilities by severity, language, and rule type, including how many are fixable by Copilot Autofix
• 🕒 Frequency — can be re-run once every 90 days (point-in-time inventory)
• 🛂 Permissions — only Organization owners / security managers can run it
• 🚀 How to run — Org → Security → Assessments → Run code security risk assessment
• 🆓 No license required, no Actions minutes charged — perfect for evaluating Code Security before purchase

📊 Pair this with Secret Risk Assessment (see Secret Scanning ↗) to get a complete picture of your organization’s security posture in a single day. Use the results to decide whether to adopt Code Security.

📘 Details:

• Code Security Risk Assessment GA (2026/04) ↗
• Code security risk assessment (GitHub Docs) ↗
• How exposed is your code? Find out in minutes — for free ↗