Code Scanning

In a nutshell

Default setup vs Advanced setup

There are two ways to enable CodeQL. Default setup is enough to start.

🔑 Unless you have a monorepo, special build requirements, or need custom queries, Default setup is best practice. You can switch to Advanced later.

📘 Details: Configuring default setup ↗

Vulnerabilities CodeQL detects

CodeQL converts code into “queryable data” before analyzing it, so it understands semantics rather than just matching patterns like grep-based SAST.

• 🐛 Injection — SQL injection / Command injection / Path traversal / XSS / SSRF
• 🔓 Auth & authorization — Broken access control, weak cryptographic algorithms (MD5/SHA1), insecure randomness
• 💣 Memory safety (C/C++) — Buffer overflow / use after free / null dereference
• 🧩 Data flow tracking — Tracks whether user input (taint source) reaches a dangerous function (sink)
• 🌐 Supported languages — C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift

🔬 CodeQL queries are open-sourced at github/codeql. You can write and extend with your own custom queries.

Copilot Autofix — AI fixes it for you ★

The killer feature of Code Scanning. When CodeQL raises an alert, AI generates a fix that you can commit directly to the PR.

• 🤖 How it works — The alert is passed to an LLM (GPT-4 family), which generates a diff based on the relevant code + surrounding context + CodeQL’s description
• 💬 Where it shows — On the alert page and inline in the PR; commit options: Commit to existing branch or Commit to new branch
• ⚡ Reduces MTTR — GitHub internal data shows fix time is 3–4× faster
• 🌐 Coverage — JavaScript/TypeScript, Python, Java/Kotlin, C#, and other CodeQL-supported languages
• 🆓 Free for OSS — Copilot Autofix on public repos has been completely free since 2024 (no Copilot subscription required)

💡 Not just “find vulnerabilities” — “let AI fix them too” is the new standard. Review burden drops dramatically.

📘 Details: About Copilot Autofix ↗

Assign to Copilot — delegate the fix to the agent (Public Preview)

What it does — Assign a Code Scanning alert directly to Copilot Coding Agent. Copilot analyzes the vulnerability, plans the fix, and opens a draft Pull Request for you to review.

• 🎯 Two ways to assign — bulk (select multiple alerts in a Security Campaign → “Assign Copilot” → 1 consolidated PR) or single (assignee picker on the alert page)
• 🤖 What Copilot does — analyzes the vulnerability → drafts a fix plan → opens a draft PR; iterate via @copilot comments on the PR
• 📦 Output — multi-file, repository-wide changes (vs Autofix’s inline single-file patch)
• 🛂 Requirements — GitHub Code Security or GHAS + Copilot Coding Agent (GHEC); the alert must already have an Autofix suggestion (Autofix-supported queries only)
• 📅 Status — Public Preview (2025-10-28)

📘 Details: Assign code scanning alerts to Copilot (changelog) ↗

Autofix vs Assign to Copilot

🔑 Rule of thumb — start with Autofix for quick local fixes; escalate to Assign to Copilot when the fix spans multiple files, needs refactoring, or warrants a full PR conversation.

Security Campaigns — drive remediation at scale

What it is — A time-boxed, org-wide remediation initiative. Curate alerts, assign owners, set a deadline, track progress on a dashboard.

• 🎯 Use case — “Fix all critical SQLi in product X by Q2” / clear security-extended backlog / chase a CVE post-incident
• 🧭 Targeting — filter by severity, CWE, query, language, repo, team, age (with preview)
• 👥 Ownership — routed to CODEOWNERS / teams; per-team progress
• ⏰ Deadline & dashboard — due date + open / fixed / overdue tracker
• 🤖 Pairs with Assign to Copilot — bulk-assign Autofix-eligible alerts → 1 PR per repo
• 🛂 Permissions — security managers / org owners at org level

How to create one

• Org → Security and quality → Campaigns → New campaign — pick From template, From code scanning filters, or From secret scanning filters

📘 Details: About security campaigns (GitHub Docs) ↗

Getting started (fastest path)

Step 1 — Enable Default setup (this alone is enough)

Repo → Settings → Code security → Code scanning
  → Set up CodeQL → Default

GitHub auto-detects your language and generates a CodeQL workflow behind the scenes. Runs automatically on push and PR — results appear in the Security tab + inline comments on the PR’s Files Changed tab.

Step 2 — Enable Copilot Autofix

Enable Copilot Autofix inside Code scanning settings. A “Generate fix” button will appear on alert pages.

Step 3 — Migrate to Advanced setup (if needed)

# .github/workflows/codeql.yml
name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [{ cron: '30 5 * * 1' }]
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions: { security-events: write, contents: read }
    strategy:
      matrix: { language: [javascript, python] }
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
      - uses: github/codeql-action/analyze@v3

Step 4 — Integrate third-party SAST tools (SARIF)

Tools like Semgrep, ESLint security, and Snyk can upload results in SARIF format to appear alongside CodeQL in the Security tab.

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Step 5 — Enable org-wide / enterprise-wide

Use Org → Settings → Code security → default settings to apply to new and existing repos at once. Security campaigns let you manage goals like “fix all critical alerts across all repos within 30 days” (Code Security).

Eligibility and pricing

💰 In 2025, GHAS was split — if you only need code scanning, GitHub Code Security ($30/month/active committer) is enough (no full GHAS contract required). Combine with Secret Protection if you also want secret scanning.
🆓 Public repos get CodeQL and Autofix completely free. If you’re OSS, there’s no reason not to enable this right now.
⚙️ Code scanning workflows run on GitHub-hosted runners — free for public repos; included in GHAS/Code Security for private repos (no additional Actions charges).

📘 Details:

• Introducing GitHub Secret Protection & Code Security (2025 Mar) ↗
• SARIF support for code scanning ↗
• Org default security settings ↗

Code Security Risk Assessment (free inventory scan)

What it does — scans the up to 20 most active repositories in your org with a single click using CodeQL, surfacing where vulnerabilities are hiding. No GHAS / Code Security license required — completely free (GA April 2026).

• 🔎 Scope — up to 20 repos with the most recent active commits (re-selectable each run)
• 📊 Output — aggregated report by severity, language, rule type, including how many are fixable by Copilot Autofix
• 🕒 Frequency — re-runnable once every 90 days (point-in-time inventory)
• 🛂 Permissions — Organization owners / security managers only
• 🚀 How to run — Org → Security → Assessments → Run code security risk assessment
• 🆓 Cost — no license, no Actions minutes charged — perfect for evaluating Code Security before purchase

📊 Pair this with Secret Risk Assessment (see Secret Scanning ↗) to get a complete picture of your organization’s security posture in a single day. Use the results to decide whether to adopt Code Security.

📘 Details:

• Code Security Risk Assessment GA (2026/04) ↗
• Code security risk assessment (GitHub Docs) ↗
• How exposed is your code? Find out in minutes — for free ↗