About code scanning with CodeQL

You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as 代码扫描 alerts in GitHub.

代码扫描 可用作 GitHub Advanced Security 的一部分,在测试期间免费使用。 更多信息请参阅“关于 GitHub Advanced Security”。

注意:代码扫描 目前处于测试阶段,可能会更改。

关于 代码扫描 与 CodeQL

CodeQL is the code analysis engine developed by GitHub to automate security checks. You can analyze your code using CodeQL and display the results as 代码扫描 alerts.

There are two main ways to use CodeQL analysis for 代码扫描:

关于 CodeQL

CodeQL treats code like data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.

  1. You generate a CodeQL database to represent your codebase.
  2. Then you run CodeQL queries on that database to identify problems in the codebase.
  3. The query results are shown as 代码扫描 alerts in GitHub AE when you use CodeQL with 代码扫描.

CodeQL 支持已编译和解译的语言,并且可在以支持的语言编写的代码中找到漏洞和错误。

  • C/C++
  • C#
  • Go
  • Java
  • JavaScript/TypeScript
  • Python

About CodeQL queries

GitHub experts, security researchers, and community contributors write and maintain the default CodeQL queries used for 代码扫描. The queries are regularly updated to improve analysis and reduce any false positive results. The queries are open source, so you can view and contribute to the queries in the github/codeql repository. 更多信息请参阅 GitHub Security Lab 网站上的 CodeQL。 You can also write your own queries. For more information, see "About CodeQL queries" in the CodeQL documentation.

You can run additional queries as part of your code scanning analysis. The queries you want to run must belong to a QL pack in a repository. Queries must only depend on the standard libraries (that is, the libraries referenced by an import LANGUAGE statement in your query), or libraries in the same QL pack as the query. 更多信息请参阅“关于 QL 包”。




所有 GitHub 文档都是开源的。看到错误或不清楚的内容了吗?提交拉取请求。


或者, 了解如何参与。