Skip to main content
GitHub Docs
Version:
Enterprise Server 3.16
Search or ask Copilot
Search or ask
Copilot
Select language: current language is English
Search or ask Copilot
Search or ask
Copilot
Open menu
Open Sidebar
Security and code quality
/
Reference
Home
Security and code quality
Getting started
GitHub security features
Dependabot quickstart
Secure repository quickstart
Add a security policy
GitHub secret types
Trial GitHub Advanced Security
Plan GHAS trial
Trial Advanced Security
Enable security features in trial
Trial Secret Protection
Trial Advanced Security
Adopt GHAS at scale
Introduction
1. Align on strategy
2. Preparation
3. Pilot programs
4. Create internal documentation
5. Rollout code scanning
6. Rollout secret scanning
Secure your organization
Enable security features
Create custom configuration
Apply custom configuration
Configure global settings
Manage organization security
Interpret security data
Filter repositories
Edit custom configuration
Manage paid GHAS use
Detach security configuration
Find attachment failures
Delete custom configuration
Troubleshoot configurations
Active advanced setup
Unexpected default setup
Not enough GHAS licenses
Feature disappears
Secret scanning
Introduction
Supported patterns
Enable features
Enable secret scanning
Enable push protection
Manage alerts
View alerts
Evaluate alerts
Resolve alerts
Monitor alerts
Work with secret scanning
Remediate a leaked secret
Push protection on the command line
Push protection in the GitHub UI
Advanced features
Exclude folders and files
Non-provider patterns
Enable for non-provider patterns
Custom patterns
Define custom patterns
Manage custom patterns
Custom pattern metrics
Delegated bypass
Enable delegated bypass
Manage bypass requests
Troubleshoot
Troubleshoot secret scanning
Code scanning
Enable code scanning
Configure code scanning
Code scanning at scale
Create advanced setup
Configure advanced setup
Customize advanced setup
CodeQL for compiled languages
CodeQL advanced setup at scale
Hardware resources for CodeQL
Code scanning in a container
Manage alerts
Assess alerts
Resolve alerts
Triage alerts in pull requests
Manage code scanning
Code scanning tool status
Edit default setup
Set merge protection
View code scanning logs
Integrate with code scanning
Using code scanning with your existing CI system
Upload a SARIF file
SARIF support
Troubleshooting code scanning
Advanced Security must be enabled
Alerts in generated code
Analysis takes too long
Automatic build failed
C# compiler failing
Cannot enable CodeQL in a private repository
Enabling default setup takes too long
Extraction errors in the database
Fewer lines scanned than expected
Logs not detailed enough
No source code seen during build
Not recognized
Out of disk or memory
Results different than expected
Some languages not analyzed
Two CodeQL workflows
Unclear what triggered a workflow
Unnecessary step found
Kotlin detected in no build
Troubleshooting SARIF uploads
GitHub Advanced Security disabled
Default setup is enabled
GitHub token missing
SARIF file invalid
Results file too large
Results exceed limits
Reference
CodeQL queries
About built-in queries
C and C++ queries
C# queries
Go queries
Java and Kotlin queries
JavaScript and TypeScript queries
Python queries
Ruby queries
Rust queries
Swift queries
CodeQL CLI
Getting started
Setting up the CodeQL CLI
Preparing code for analysis
Analyzing code
Uploading results to GitHub
Customizing analysis
Advanced functionality
Advanced setup of the CodeQL CLI
Using custom queries with the CodeQL CLI
Creating CodeQL query suites
Testing custom queries
Testing query help files
Creating and working with CodeQL packs
Publishing and using CodeQL packs
Specifying command options in a CodeQL configuration file
CodeQL CLI SARIF output
CodeQL CLI CSV output
Extractor options
Exit codes
Creating CodeQL CLI database bundles
CodeQL CLI manual
bqrs decode
bqrs diff
bqrs hash
bqrs info
bqrs interpret
database add-diagnostic
database analyze
database bundle
database cleanup
database create
database export-diagnostics
database finalize
database import
database index-files
database init
database interpret-results
database print-baseline
database run-queries
database trace-command
database unbundle
database upgrade
dataset check
dataset cleanup
dataset import
dataset measure
dataset upgrade
diagnostic add
diagnostic export
execute cli-server
execute language-server
execute queries
execute query-server
execute query-server2
execute upgrades
generate extensible-predicate-metadata
generate log-summary
generate overlay-changes
generate query-help
github merge-results
github upload-results
pack add
pack bundle
pack ci
pack create
pack download
pack init
pack install
pack ls
pack packlist
pack publish
pack resolve-dependencies
pack upgrade
query compile
query decompile
query format
query run
resolve database
resolve extensions
resolve extensions-by-pack
resolve extractor
resolve files
resolve languages
resolve library-path
resolve metadata
resolve ml-models
resolve packs
resolve qlpacks
resolve qlref
resolve queries
resolve ram
resolve tests
resolve upgrades
test accept
test extract
test run
version
CodeQL for VS Code
Getting started
Extension installation
Manage CodeQL databases
Run CodeQL queries
Explore data flow
Advanced functionality
CodeQL model editor
Custom query creation
Manage CodeQL packs
Explore code structure
Test CodeQL queries
Customize settings
CodeQL workspace setup
CodeQL CLI access
Telemetry
Troubleshooting CodeQL for VS Code
Access logs
Security advisories
Global security advisories
Browse Advisory Database
Edit Advisory Database
Supply chain security
Understand your supply chain
Dependency graph ecosystem support
Customize dependency review action
Enforce dependency review
Troubleshoot dependency graph
End-to-end supply chain
Overview
Securing accounts
Securing code
Securing builds
Dependabot
Dependabot ecosystems
Dependabot ecosystem support
Dependabot alerts
View Dependabot alerts
Dependabot auto-triage rules
Manage auto-dismissed alerts
Dependabot version updates
Optimize PR creation
Customize Dependabot PRs
Work with Dependabot
Use Dependabot with Actions
Dependabot options reference
Troubleshoot Dependabot
Viewing Dependabot logs
Dependabot stopped working
Troubleshoot Dependabot on Actions
Security overview
View security insights
Assess adoption of features
Assess security risk of code
Filter security overview
View secret scanning metrics
View PR alert metrics
Review bypass requests
Concepts
Secret security
Secret scanning
Push protection
Secret scanning alerts
Delegated bypass
Push protection from the REST API
Code scanning
Introduction
Code scanning alerts
Evaluate code scanning
Integration with code scanning
CodeQL
CodeQL code scanning
CodeQL query suites
CodeQL CLI
CodeQL for VS Code
CodeQL workspaces
Query reference files
Supply chain security
Supply chain features
Dependency best practices
Dependency graph
Dependency review
Dependabot alerts
Dependabot security updates
Dependabot version updates
Dependabot auto-triage rules
Vulnerability reporting
GitHub Advisory database
Global security advisories
Security at scale
Organization security
Security configurations
Security overview
Audit security alerts
Supply chain security
How-tos
Secure your supply chain
Secure your dependencies
Configure Dependabot alerts
Configure security updates
Configure version updates
Auto-update actions
Configure dependency graph
Explore dependencies
Use dependency submission API
Manage your dependency security
Auto-triage Dependabot alerts
Prioritize with preset rules
Customize Dependabot PRs
Control dependency update
Configure dependency review action
Optimize Java packages
Configure Dependabot notifications
Configure access to private registries
Remove access to public registries
Manage Dependabot PRs
List configured dependencies
Configure private registries
Troubleshoot dependency security
Troubleshoot Dependabot errors
Troubleshoot vulnerability detection
Establish provenance and integrity
Export dependencies as SBOM
Reference
Tutorials
Secure your organization
Prevent data leaks
Responsible use
Security and code quality
/
Reference
Reference for security and code quality
Find information to apply to your work with GitHub's security and code quality features.