Finding security vulnerabilities and errors in your code with code scanning
Keep your code secure by using code scanning to identify and fix potential security vulnerabilities and other errors in your code.
Who can use this feature?
Code scanning is available for the following repository types:
- Organization-owned repositories with GitHub Advanced Security enabled
- Introduction to code scanning
- Enabling code scanning
- Creating an advanced setup for code scanning
- Managing code scanning alerts
- Managing your code scanning configuration
- About the tool status page for code scanning
- Editing your configuration of default setup
- Set code scanning merge protection
- CodeQL query suites
- Viewing code scanning logs
- C and C++ queries for CodeQL analysis
- C# queries for CodeQL analysis
- GitHub Actions queries for CodeQL analysis
- Go queries for CodeQL analysis
- Java and Kotlin queries for CodeQL analysis
- JavaScript and TypeScript queries for CodeQL analysis
- Python queries for CodeQL analysis
- Ruby queries for CodeQL analysis
- Rust queries for CodeQL analysis
- Swift queries for CodeQL analysis
- Integrating with code scanning
- Troubleshooting code scanning
- Error: "GitHub Advanced Security must be enabled for this repository to use code scanning"
- Alerts found in generated code
- Code scanning analysis takes too long
- Automatic build failed for a compiled language
- C# compiler unexpectedly failing
- Cannot enable CodeQL in a private repository
- Enabling default setup takes too long
- Extraction errors in the database
- CodeQL scanned fewer lines than expected
- Logs are not detailed enough
- Error: "No source code was seen during the build"
- Error: "is not a .ql file, .qls file, a directory, or a query pack specification"
- Error: "Out of disk" or Error: "Out of memory"
- Results are different than expected
- Some languages were not analyzed with CodeQL advanced setup
- Two CodeQL workflows
- Unclear what triggered a workflow run
- Warning: "1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary"
- Warning: Detected X Kotlin files in your project that could not be processed without a build
- Troubleshooting SARIF uploads