Code Scanning — Playbook

In a nutshell

Code Scanning finds vulnerabilities through static analysis (SAST), without running your code.

CodeQL turns code into a queryable database. Eligible findings can get Copilot Autofix suggestions or be assigned to Copilot for a fix.

What is SAST?

Application security testing splits into four families. Code Scanning owns SAST (Static Application Security Testing): reading the source itself, without executing it.

▸ CLICK FOR DETAILS

SAST (static)

SAST — static analysis

Reads source without running it, so it fires at commit and PR time where fixes are cheapest. It sees every code path, including ones testing never reaches, but is blind to runtime-only problems like misconfiguration. Its classic weakness is false positives — exactly what CodeQL's data-flow analysis attacks.

GitHub feature: Code Scanning / CodeQL

DAST (dynamic)

DAST — dynamic analysis

Fires real attack requests at a running app. It proves exploitability, but only for what is already deployed and crawlable, and it cannot point at the offending line.

No first-party GitHub feature. Ingest results via SARIF

SCA (dependencies)

SCA — software composition analysis

Finds known CVEs in libraries you did not write. Most of a modern app is dependencies, so by raw count this is usually the biggest source of findings.

GitHub feature: Dependabot / Dependency review

Secret scanning

Secret scanning — leaked credentials

Not vulnerabilities but keys and tokens committed into the repo. The cheapest way in for an attacker, so it often outranks SAST on priority.

GitHub feature: Secret Protection

SELECT A METHOD ▸

🔑 Rule of thumb — SAST finds bugs in the code you wrote, SCA finds bugs in the code someone else wrote. Different territory, so neither one covers the other.

Code scanning is not CodeQL 📖 Docs

Code scanning is the GitHub feature; CodeQL is one analysis engine. AI findings complement it on pull requests, and third-party tools can supply SARIF results.

▸ CLICK FOR DETAILS

Code scanning (the feature)

Code scanning — GitHub's surface

The feature that collects static-analysis results and surfaces them: Security tab alerts, inline PR comments, merge protection, Security overview, APIs. Whatever the engine, results land here.

CodeQL (the engine)

CodeQL — the analysis engine

The semantic analysis engine GitHub acquired from Semmle in 2019. It is the default engine on GitHub, but it also runs outside GitHub — the CodeQL CLI works in any CI, or locally on your laptop.

AI findings (PR only)

AI security detections

Complement CodeQL for uncovered languages and frameworks, such as PHP, Bash, HCL and Dockerfiles. Pull requests only: no full-repo scan or backlog alerts. Advisory, not a merge gate. Requires opt-in and CodeQL default setup; consumes AI credits.

Public preview: GHAS + Copilot licenses. 📘 Docs ↗

SARIF (the contract)

SARIF — the format that joins them

The OASIS standard format for static-analysis results. Push Semgrep, Snyk or Checkmarx through upload-sarif and their findings sit next to CodeQL's, same screen.

📘 SARIF support ↗

SELECT A TOPIC ▸

How CodeQL works 📖 Docs

Extract code into a database, then compile and evaluate queries against it.

The schema describes the data; the database stores it. Extraction reads source directly or monitors a build, depending on the language and build mode ↗.

Reading a CodeQL query

QL is a declarative logic-programming language. You describe the shape of a bug and the evaluator finds every instance. The structure mirrors SQL’s FROM / WHERE / SELECT.

import java                                       // ① pull in the standard library

from IfStmt ifstmt, Block block                   // ② declare the elements to inspect
where
  block = ifstmt.getThen() and                    // ③ constrain them
  block.getNumStmt() = 0                          //    → a then-branch with no statements
select ifstmt, "This if-statement is redundant."  // ④ what to report, and how

The whole language is that shape: where is the definition of “what the bug looks like”, and the evaluator does the searching.

🔬 Security queries layer DataFlow / TaintTracking on top, defining sources, sinks and sanitizers and searching for paths between them. The packs are open source at github/codeql ↗. In practice they are enough — you write custom queries mainly to teach CodeQL the sources and sinks of your in-house framework.

📘 Details: About CodeQL queries ↗ / About data flow analysis ↗

What CodeQL finds

▸ CLICK FOR DETAILS

Injection

SQL injection, command injection, path traversal, XSS, SSRF. User input reaching an interpreter (SQL, a shell, a file path, HTML, an HTTP client) without escaping. This is CodeQL's home turf and where data-flow analysis pays for itself.

Auth, authz & crypto

Auth, authorization and crypto

Broken access control, weak cryptographic algorithms (MD5 / SHA-1), insecure randomness, hard-coded credentials, disabled certificate validation.

Memory safety (C/C++)

Buffer overflow, use after free, null dereference, integer overflow. Only reachable because types and pointer flow live in the database — regex-based tools cannot go here.

Data flow tracking

Data flow tracking (taint tracking)

The alert carries the path itself, source to sink. Anything crossing a sanitizer drops out, which is what keeps false positives down. models-as-data lets you register your own framework's sources and sinks without writing a query.

📘 sanitizers in models-as-data ↗

CI/CD (Actions)

CI/CD (GitHub Actions)

Workflows are analysed too: pull_request_target combined with an untrusted checkout, script injection, excessive permissions, unpinned third-party actions — the supply-chain side of the repo.

SELECT A CATEGORY ▸

🌐 Supported languages — C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, GitHub Actions. A repo with no CodeQL-supported language runs no scans and burns no Actions minutes.

Default setup vs Advanced setup

There are two ways to enable CodeQL. Default setup is enough to start.

▸ CLICK TO COMPARE

Default setup

Default setup — one click

No config file. GitHub detects languages, picks the default suite, and wires push / PR / weekly triggers. Most languages need no build step, and one settings screen turns it on org-wide — the only realistic option at scale.

Best for: 99% of repos, and any rollout at scale

Advanced setup

Advanced setup — your own workflow

You own .github/workflows/codeql.yml: languages, triggers, your own build command, any query suite (security-extended, custom packs). The price is a workflow file per repo to maintain.

Best for: monorepos, custom builds, custom queries

Billing difference

There is none

Both run as Actions workflows and burn minutes on private repos at the same rate, so neither choice saves money. What moves the bill is scan frequency, repo size and runner type.

See the pricing slide for the three meters

SELECT AN OPTION ▸

🔑 Unless you have a monorepo, special build requirements, or need custom queries, start with Default setup — you can switch to Advanced later without losing history.

📘 Details: Configuring default setup ↗

Copilot Autofix: suggested fixes 📖 Docs

Copilot Autofix can generate a suggested patch for an eligible alert. You review, test and apply it; a successful fix is not guaranteed.

🤖 Input: alert details, surrounding code and CodeQL’s data-flow path inform the suggestion.
💬 On pull requests: supported alerts can receive inline suggestions automatically.
🛠️ On backlog alerts without cloud agent: Generate fix → Create PR with fix.
🆓 Cost: no Copilot license or AI credits for classic Autofix. Included with Code Security; free on public repositories.
🔌 Enablement: allowed by default with CodeQL unless an administrator disables it.

Agentic Autofix (Public Preview) 📖 Docs

When cloud agent is available, Assign to Copilot replaces Generate fix on individual code scanning alerts.

🎯 Assign: one alert, or 1–25 alerts from a repository backlog or security campaign.
🔁 Agent session: explore the codebase → generate a fix → validate and iterate → open a draft PR.
🛂 Requirements: cloud agent and Autofix must both be available. No pre-generated Autofix suggestion is required.
💸 Cost: AI credits + Actions minutes. Without cloud agent, the classic Generate fix flow remains available for eligible alerts.
⚠️ Validation is best-effort: custom queries, security-extended and third-party alerts are not guaranteed to be validated.

Autofix vs Agentic Autofix 📖 Docs

▸ CLICK + TO OPEN THE COMPARISON

Outputpatch vs PR

🔧 AutofixA suggested patch to review and apply. For backlog alerts, Create PR with fix opens a draft PR from the suggestion

🤖 AgenticA draft Pull Request opened by the Copilot bot, reviewed like any other

Fix scopesuggestion vs exploration

🔧 AutofixA targeted suggestion based on the alert and supplied code context

🤖 AgenticMultiple files, with repository-wide context — refactors and shared helpers included

Granularityper-alert vs bulk

🔧 AutofixGenerate fix on eligible backlog alerts without cloud agent; PR suggestions can be batch-applied

🤖 AgenticAssign 1–25 alerts from a repository backlog or campaign to get a fix PR

Validation & iterationone-shot vs dialogue

🔧 AutofixA one-step suggestion: review and test it on a PR before merging

🤖 AgenticValidates and iterates on a best-effort basis. Read the session log; use @copilot comments for further changes

Speedseconds vs minutes

🔧 AutofixSeconds, synchronous — you judge it while looking at the alert

🤖 AgenticMinutes, async in the background; a session is capped at 59 minutes

License & costfree vs metered

🔧 AutofixFree. No Copilot license, no AI credits. Included with Code Security / GHAS

🤖 AgenticNeeds a paid Copilot plan with cloud agent, and burns AI credits + Actions minutes

🔑 On individual alert pages, repository availability determines the button: cloud agent available → Assign to Copilot; otherwise → Generate fix for eligible alerts. PR inline Autofix suggestions remain a separate experience.

Security Campaigns — drive remediation at scale

Detection is the easy half; what happens after the alert is the real work. At scale, don’t grind the raw alert list — run a time-boxed campaign.

▸ CLICK A STEP FOR DETAILS

SCOPE

🎯 SCOPE — not the whole org

Org → Security and quality → Campaigns → New campaign, then pick From template or From code scanning filters.

Filter by severity, CWE, query, language, repo, team, age. Targeting a repo custom property (props.BusinessPriority:Urgent) is the usual move. Hard cap: 1000 alerts.

TRIAGE

⚡ TRIAGE — make it finishable

Start with critical and high, and with findings that carry a real reachable data-flow path. Dumping the whole security-extended backlog in guarantees nobody starts.

Watch the count drop as you filter. Cutting it down to one sprint's worth is the only trick that makes campaigns work.

OWN

👥 OWN — a name and a date

Every campaign gets a due date and a campaign manager. The picker only offers org owners and security managers.

Alerts route to CODEOWNERS or a named team. Publishing notifies everyone who can see the alerts, and the campaign appears in each repo's Security tab.

FIX

🤖 FIX — hand the batch to Copilot

Select 1–25 alerts and assign them to Copilot. With cloud agent available, it starts Agentic Autofix and consumes AI credits + Actions minutes.

For the rest, batch apply the Autofix suggestions on the PR. The dashboard burns down open / fixed / overdue as you go.

SELECT A STEP ▸

📘 Details: About security campaigns (GitHub Docs) ↗

Getting started (fastest path)

Repo → Settings → Code security ▸ STEP 1 · DEFAULT SETUP

Set up CodeQL → Default. Languages are detected for you; it runs on push and PR.

Alert → Fix ▸ STEP 2 · AUTOFIX

Cloud agent available: Assign to Copilot (metered). Otherwise: Generate fix for eligible alerts (no AI credits).

Org → Settings → Code security ▸ STEP 3 · ROLL OUT

Build a security configuration and apply it to new and existing repos at once.

Repo → Settings → Rules ▸ STEP 4 · MERGE PROTECTION

Code scanning alone never blocks a merge. Make it required in a ruleset.

Results appear in the Security tab and the PR’s Files changed tab. Start with one repo and estimate Actions usage before rolling out.

Advanced setup and SARIF

When Default is not enough (monorepo, unusual build, custom queries, another SAST tool), write the workflow yourself.

# .github/workflows/codeql.yml
name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [{ cron: '30 5 * * 1' }]
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions: { security-events: write, contents: read }
    strategy:
      matrix: { language: [javascript, python] }
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with: { languages: '${{ matrix.language }}', queries: security-extended }
      - uses: github/codeql-action/analyze@v3

      # third-party SAST (Semgrep, Snyk, ESLint security) lands in the same UI:
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: results.sarif }

💡 Point runs-on at a self-hosted runner and the Actions minutes are not billed — the first lever when scan cost bites at scale.

Pricing: three meters 📖 Docs

▸ + UNFOLDS THE DETAIL

Cost	How it is measured	Good to know
💺 License	$30 / active committer / month GitHub Code Security	What's included CodeQL (default and advanced), Copilot Autofix, SARIF upload, Security overview, Security campaigns, custom queries. Autofix costs nothing extra. Who counts Active committers have a commit pushed to an enabled repo in the last 90 days. One license per person across enabled repos and orgs in the enterprise; GitHub App bots are excluded. Code Security is sold standalone.
⚙️ Actions minutes	CodeQL runs on Actions. Private scans consume minutes; overages are billed.	When it runs Default setup runs on pushes to the default or protected branches, PRs against them and a weekly schedule. Minutes depend on run duration, repository count, languages and frequency. Cap the spend Self-hosted runners are not billed, or set an Actions budget. Minutes are not included in the Code Security license. Trap: larger runners are charged even on public repos. Measure it Filter Actions usage metrics by workflow name to isolate what CodeQL alone costs, so the conversation runs on real numbers instead of estimates. `github.com/orgs/<org>/actions/metrics/usage?filters=codeql.yml`
🤖 AI credits	Metered: AI findings (detection) and Agentic Autofix (fixing). Classic Autofix suggestions remain free.	AI findings Opt-in AI detection for non-CodeQL languages (PHP, Shell, Terraform, Dockerfile), on PRs only. Consumes AI credits even without a fix request. Public preview requires GHAS + Copilot licenses and CodeQL default setup. Docs ↗ Copilot Autofix No Copilot license needed and it does not consume AI credits. Included with Code Security at no additional cost. Agentic Autofix Billed as a cloud agent session, drawing down AI credits and Actions minutes (1 credit = $0.01, varying with model and tokens). User budgets hard-stop; org budgets only cap once the pool is spent.

Eligibility by repository type 📖 Docs

Feature	Public repo	Private repo without Code Security	Private repo with Code Security
Core code scanning	✅ Free	❌	✅ Included
Security campaigns	❌	❌	✅ Included
Actions minutes	Free*	Not applicable	Separate usage*

📦 Core: CodeQL, custom queries, SARIF uploads, eligible Autofix suggestions, PR annotations and Security overview.

💰 Actions*: standard hosted runners are free for public repos. Private repos consume included minutes, then bill overages. Larger runners are always billed.

⚠️ Public → private: Code Security is required to keep code scanning enabled.

Code Security Risk Assessment (free inventory scan)

One click, CodeQL scans the 20 most active repos in your org and shows where the vulnerabilities are. No GHAS / Code Security license needed, completely free (GA April 2026).

🔎 Scope — up to 20 repos with the most recent commits, re-selectable each run
📊 Output — report by severity, language, rule type, plus how many Copilot Autofix can fix
🕒 Frequency — re-runnable once every 90 days; org owners / security managers only
🚀 How to run — Org → Security → Assessments → Run code security risk assessment
🆓 Cost — no license, no Actions minutes — ideal for evaluating Code Security before buying

📊 Pair this with Secret Risk Assessment (see Secret Scanning ↗) and you get a full posture read in a single day, then decide on Code Security with real numbers.

📘 Details: Code security risk assessment ↗ / How exposed is your code? ↗