Learn core concepts for GitHub's code scanning features.
You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.
Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.
Generate a free code security risk assessment to understand your organization's exposure to vulnerabilities.
About autofix for code scanning
Autofix generates potential fixes for code scanning alerts, helping you remediate existing vulnerabilities.
AI Scan uses an AI-based scanning engine to find security vulnerabilities in pull requests for languages and frameworks not covered by CodeQL.
About setup types for code scanning
Depending on your needs, GitHub offers a default or advanced setup for code scanning.
Integration with code scanning
You can perform code scanning externally and then display the results in GitHub, or configure webhooks that listen to code scanning activity in your repository.
About SARIF files for code scanning
SARIF files convert third-party analyses into alerts on GitHub.
Code scanning alert tracking using issues
Connect security findings to your team's workflow by linking code scanning alerts to issues for tracking and collaboration.
Code scanning merge protection
Code scanning rules prevent pull requests with potential vulnerabilities from being merged.
Multi-repository variant analysis
MRVA lets you test a query in Visual Studio Code by running it against a large number of repositories.
Understand the core concepts behind CodeQL and how it helps you find vulnerabilities and errors in your code.
The tool status page provides visibility into the health and performance of code scanning tools in your repository.
Code scanning on pull requests
Understand how CodeQL and AI Scan find and help prevent vulnerabilities in pull requests across your organizations.
Repository properties for code scanning
You can use repository properties to adjust code scanning to suit your needs.