Automatically scanning your code for vulnerabilities and errors

You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.

Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.

When code scanning identifies a problem in a pull request, you can review the highlighted code and resolve the alert.

You can configure code scanning for a repository to find security vulnerabilities in your code.

From the security view, you can view, fix, dismiss, or delete alerts for potential vulnerabilities or errors in your project's code.

You can customize how GitHub scans the code in your project for vulnerabilities and errors.

You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.

Recommended specifications (RAM, CPU cores, and disk) for running CodeQL analysis on self-hosted machines, based on the size of your codebase.

You can configure how GitHub uses the CodeQL analysis workflow to scan code written in compiled languages for vulnerabilities and errors.

If you're having problems with code scanning setup, you can troubleshoot by using these tips for resolving issues.

You can run code scanning in a container by ensuring that all processes run in the same container.

You can view the output generated during code scanning analysis in your GitHub Enterprise Server instance.