Skip to main content
Frecuentemente publicamos actualizaciones de nuestra documentación. Es posible que la traducción de esta página esté en curso. Para conocer la información más actual, visita la documentación en inglés. Si existe un problema con las traducciones en esta página, por favor infórmanos.

About code scanning alerts

Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.

El Escaneo de código se encuentra disponible para los repositorios que pertenecen a organizaciones donde se habilitó el GitHub Advanced Security. Para obtener más información, consulta la sección "Acerca de GitHub Advanced Security".

Nota: Tu administrador de sitio debe habilitar el escaneo de código para tu instancia de GitHub Enterprise Server antes de que puedas utilizar esta característica. Para obtener más información, consulta "Configurar el escaneo de código en tu aplicativo."

About alerts from escaneo de código

You can set up escaneo de código to check the code in a repository using the default CodeQL analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by GitHub's default CodeQL analysis. For more information, see "Setting up escaneo de código for a repository."

By default, escaneo de código analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "Triaging escaneo de código alerts in pull requests."

About alert details

Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity, security severity, and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by CodeQL analysis, you will also see information on how to fix the problem.

Example alert from escaneo de código

If you set up escaneo de código using CodeQL, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.

When escaneo de código reports data-flow alerts, GitHub shows you how data moves through the code. Escaneo de código allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.

About severity levels

Alert severity levels may be Error, Warning, or Note.

If escaneo de código is enabled as a pull request check, the check will fail if it detects any results with a severity of error. You can specify which severity level of code scanning alerts causes a check failure. For more information, see "Defining the severities causing pull request check failure."

About security severity levels

Escaneo de código displays security severity levels for alerts that are generated by security queries. Security severity levels can be Critical, High, Medium, or Low.

To calculate the security severity of an alert, we use Common Vulnerability Scoring System (CVSS) data. CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities, and is commonly used by other security products to score alerts. For more information about how severity levels are calculated, see this blog post.

By default, any escaneo de código results with a security severity of Critical or High will cause a check failure. You can specify which security severity level for escaneo de código results should cause a check failure. For more information, see "Defining the severities causing pull request check failure."

About labels for alerts that are not found in application code

GitHub Enterprise Server assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.

  • Generated: Code generated by the build process
  • Test: Test code
  • Library: Library or third-party code
  • Documentation: Documentation

Escaneo de código categorizes files by file path. You cannot manually categorize source files.

Here is an example from the escaneo de código alert list of an alert marked as occurring in library code.

Code scanning library alert in list

On the alert page, you can see that the filepath is marked as library code (Library label).

Code scanning library alert details