Automatically scanning your code for vulnerabilities and errors

You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.

You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.

You can quickly secure code in your repository with default setup for code scanning.

You can quickly configure code scanning for repositories across your organization using default setup.

Understand the autobuild method CodeQL analysis uses to build code for compiled languages and learn how you can customize the build command if you need to.

You can configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration.

You can customize how GitHub scans the code in your project for vulnerabilities and errors.

You can use a script to configure advanced setup for code scanning for a specific group of repositories in your organization.

Recommended specifications (RAM, CPU cores, and disk) for running CodeQL analysis on self-hosted machines, based on the size of your codebase.

You can run code scanning in a container by ensuring that all processes run in the same container.

Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.

From the security view, you can view, fix, or dismiss alerts for potential vulnerabilities or errors in your project's code.

When code scanning identifies a problem in a pull request, you can review the highlighted code and resolve the alert.

You can add code scanning alerts to issues using task lists. This makes it easy to create a plan for development work that includes fixing alerts.

The tool status page shows useful information about all of your code scanning tools. If code scanning is not working as you'd expect, the tool status page is a good starting point for debugging problems.

You can choose from different built-in CodeQL query suites to use in your CodeQL code scanning setup.

You can view the output generated during code scanning analysis in GitHub.com.