Skip to main content
GitHub Docs
Version:
Free, Pro, & Team
Search or ask Copilot
Search or ask
Copilot
Select language: current language is English
Search or ask Copilot
Search or ask
Copilot
Open menu
Open Sidebar
Security and code quality
/
How-tos
Home
Security and code quality
Getting started
GitHub security features
Secure repository quickstart
Concepts
Secret security
Secret scanning
Push protection
Secret protection tools
Secret scanning alerts
Delegated bypass
Bypass requests
Secret scanning for partners
GitHub secret types
Command line protection
Push protection and the GitHub MCP server
Push protection from the REST API
Code scanning
Introduction
Code scanning alerts
Setup types
Integration with code scanning
CodeQL
CodeQL code scanning
CodeQL query suites
CodeQL CLI
CodeQL for VS Code
CodeQL workspaces
Query reference files
CodeQL query packs
GitHub Code Quality
Supply chain security
Supply chain features
Dependency best practices
Dependency graph
Dependency review
Dependabot alerts
Dependabot security updates
Dependabot version updates
Dependabot pull requests
dependabot.yml file
Dependabot auto-triage rules
Dependabot on Actions
Immutable releases
Linked artifacts
Vulnerability reporting
GitHub Advisory database
Repository security advisories
Global security advisories
Coordinated disclosure
Vulnerability exposure
Security at scale
Organization security
Choose security configuration
Security overview
Security campaigns
Audit security alerts
How-tos
Secure at scale
Configure enterprise security
Configure specific tools
Allow Code Quality
Configure VNET
Configure organization security
Establish complete coverage
Apply recommended configuration
Create custom configuration
Apply custom configuration
Configure global settings
Manage your coverage
Edit custom configuration
Filter repositories
Detach security configuration
Delete custom configuration
Configure specific tools
Assess your secret risk
View risk report
Secret protection pricing
Push protection cost savings
Protect your secrets
Code scanning at scale
CodeQL advanced setup at scale
Enforce dependency review
Configure for an organization
Manage usage and access
Give access to private registries
Manage paid GHAS use
Troubleshoot security configurations
Active advanced setup
Unexpected default setup
Find attachment failures
Not enough GHAS licenses
Secure your secrets
Leak detection
Enable secret scanning
Enable for non-provider patterns
Enable generic secret detection
Detection customization
Define custom patterns
Generate regular expressions
Manage custom patterns
Exclude folders and files
Enable validity checks
Enable metadata checks
Troubleshoot secret scanning
Leak prevention
Enable push protection
Push protection for users
Push protection
Push protection on the command line
Push protection in the GitHub UI
Bypass requests
Enable delegated bypass
Manage bypass requests
Review bypass requests
Scan code for vulnerabilities
Configure code scanning
Configure code scanning
Configure advanced setup
Customize advanced setup
Manage your configuration
Code scanning tool status
Edit default setup
Set merge protection
Configure larger runners
CodeQL for compiled languages
Scan from the command line
Set up the CodeQL CLI
Advanced setup of the CodeQL CLI
Use custom queries with the CodeQL CLI
Test query help files
Specify command options in a CodeQL configuration file
Creating CodeQL CLI database bundles
Scan from VS Code
Extension installation
Manage CodeQL databases
Run CodeQL queries
Explore data flow
Run queries at scale
Use the model editor
Custom query creation
Manage CodeQL packs
Explore code structure
Test CodeQL queries
Customize settings
CodeQL workspace setup
CodeQL CLI access
Integrate with existing tools
Use with existing CI system
Upload a SARIF file
Troubleshoot
Troubleshooting CodeQL for VS Code
Access logs
Problem with controller repository
Troubleshoot analysis errors
Alerts in generated code
Automatic build failed
C# compiler failing
Cannot enable CodeQL in a private repository
Analysis takes too long
Fewer lines scanned than expected
Enabling default setup takes too long
Code Security must be enabled
Out of disk or memory
Resource not accessible
Not recognized
No source code seen during build
Server error
Extraction errors in the database
Logs not detailed enough
Results different than expected
Some languages not analyzed
Two CodeQL workflows
Unclear what triggered a workflow
Unnecessary step found
Kotlin detected in no build
Troubleshoot SARIF uploads
GitHub token missing
SARIF file invalid
Results exceed limits
Results file too large
GitHub Code Security disabled
Default setup is enabled
Secure your supply chain
Secure your dependencies
Configure Dependabot alerts
Configure security updates
Configure version updates
Auto-update actions
Enable dependency graph
Explore dependencies
Submit dependencies automatically
Use dependency submission API
Verify release integrity
Manage your dependency security
Auto-triage Dependabot alerts
Prioritize with preset rules
Customize Dependabot PRs
Control dependency update
Configure dependency review action
Optimize Java packages
Configure Dependabot notifications
Configure access to private registries
Remove access to public registries
Manage Dependabot PRs
Configure on GitHub-hosted runners
Configure on self-hosted runners
Re-run Dependabot jobs
List configured dependencies
Configure private registries
Troubleshoot dependency security
Troubleshoot Dependabot errors
Troubleshoot vulnerability detection
Dependabot stopped working
Troubleshoot dependency graph
Troubleshoot Dependabot on Actions
Establish provenance and integrity
Prevent release changes
Export dependencies as SBOM
Upload linked artifacts
View linked artifacts
Remove linked artifacts
Manage security alerts
Remediate at scale
Filter security alerts
Create security campaign
Track security campaign
Fix alerts in campaign
Review alert dismissal requests
Secret scanning alerts
Monitor alerts
View alerts
Resolve alerts
Delegated alert dismissal
Code scanning alerts
Assess alerts
Triage alerts in pull requests
Resolve alerts
Enable delegated alert dismissal
Disable Copilot Autofix
Dependabot alerts
View Dependabot alerts
Manage auto-dismissed alerts
Enable delegated alert dismissal
Maintain quality code
Enable Code Quality
Interpret results
Set PR thresholds
Unblock your PR
Report and fix vulnerabilities
Configure vulnerability reporting
Add a security policy
Configure for a repository
Report and evaluate
Report privately
Evaluate repository security
Fix vulnerabilities
Manage vulnerability reports
Create repository advisory
Publish repository advisory
Add collaborators
Remove collaborators
Edit repository advisories
Delete repository advisories
Browse Advisory Database
Edit Advisory Database
View and interpret data
Analyze organization data
Assess security risk of code
Assess adoption of features
Export data
View security insights
Interpret security data
View PR alert metrics
View secret scanning metrics
View Dependabot metrics
Export risk report CSV
View code scanning logs
View Dependabot logs
Custom pattern metrics
Change "used by" data
Reference
Secret security
GitHub secret types
Supported patterns
Risk report CSV contents
Code scanning
SARIF support
CodeQL
Hardware resources for CodeQL
Telemetry
CodeQL queries
About built-in queries
Actions queries
C and C++ queries
C# queries
Go queries
Java and Kotlin queries
JavaScript and TypeScript queries
Python queries
Ruby queries
Rust queries
Swift queries
CodeQL CLI
CodeQL CLI SARIF output
CodeQL CLI CSV output
Extractor options
Exit codes
CodeQL CLI manual
bqrs decode
bqrs diff
bqrs hash
bqrs info
bqrs interpret
database add-diagnostic
database analyze
database bundle
database cleanup
database create
database export-diagnostics
database finalize
database import
database index-files
database init
database interpret-results
database print-baseline
database run-queries
database trace-command
database unbundle
database upgrade
dataset check
dataset cleanup
dataset import
dataset measure
dataset upgrade
diagnostic add
diagnostic export
execute cli-server
execute language-server
execute queries
execute query-server
execute query-server2
execute upgrades
generate extensible-predicate-metadata
generate log-summary
generate overlay-changes
generate query-help
github merge-results
github upload-results
pack add
pack bundle
pack ci
pack create
pack download
pack init
pack install
pack ls
pack packlist
pack publish
pack resolve-dependencies
pack upgrade
query compile
query decompile
query format
query run
resolve database
resolve extensions
resolve extensions-by-pack
resolve extractor
resolve files
resolve languages
resolve library-path
resolve metadata
resolve ml-models
resolve packs
resolve qlpacks
resolve qlref
resolve queries
resolve ram
resolve tests
resolve upgrades
test accept
test extract
test run
version
Supply chain security
Dependabot options
Dependabot alerts filters
Dependency scope
Dependabot PR comment commands
Dependabot ecosystems
Dependency graph ecosystems
Dependabot on Actions
Code quality
Metrics and ratings
CodeQL analysis
CodeQL queries
C# queries
Go queries
Java queries
JavaScript queries
Python queries
Ruby queries
Permissions for security features
Repository security advisories
Security overview
Tutorials
Trial GitHub Advanced Security
Plan GHAS trial
Trial Advanced Security
Enable security features in trial
Trial Secret Protection
Trial Code Security
Secure your organization
Prevent data leaks
Fix alerts at scale
Prioritize alerts in production code
Interpret secret risk assessment
Organize leak remediation
Remediate leaked secrets
Evaluate alerts
Remediate a leaked secret
Partner program
Customize code scanning
Evaluate default setup
Preparing code for analysis
Analyzing code
Uploading results to GitHub
Code scanning in a container
Customizing analysis
Creating CodeQL query suites
Testing custom queries
Creating and working with CodeQL packs
Publishing and using CodeQL packs
Secure your dependencies
Dependabot quickstart
Use Dependabot with Actions
Optimize PR creation
Configure ARC
Configure multi-ecosystem updates
Customize Dependabot PRs
Customize dependency review action
Implement supply chain best practices
Overview
Securing accounts
Securing code
Securing builds
Manage security alerts
Prioritize Dependabot alerts using metrics
Best practices for campaigns
Improve code quality
Quickstart
Fix findings in PRs
Improve your codebase
Improve recent merges
Fix reported vulnerabilities
Collaborate in a fork
Write security advisories
Responsible use
Copilot Autofix for code scanning
Copilot secret scanning
Regular expressions generator
Code quality
Security and code quality
/
How-tos
How-tos for security and code quality
Learn how to use GitHub's security and code quality features.
Secure at scale
Configure enterprise security
Configuring security features in your organization
Troubleshoot security configurations
How-tos for securing secrets
How-tos for detecting secret leaks
How-tos for customizing secret leak detection
Troubleshooting secret scanning
How-tos for leak prevention
How-tos for push protection
How-tos for bypass requests
Scan code for vulnerabilities
Configure code scanning
Manage your configuration
Scan from the command line
Scan from VS Code
Integrate with existing tools
Troubleshooting
Securing your supply chain
Securing your dependencies
Managing your dependency security
Troubleshooting dependency security
Establishing provenance and integrity for your projects
Managing security alerts
Remediate alerts at scale
Manage secret scanning alerts
Manage code scanning alerts
Manage Dependabot alerts
Maintain quality code
Enabling GitHub Code Quality
Interpreting the code quality results for your repository
Setting code quality thresholds for pull requests
Resolving a block on your pull request
How-tos for reporting and fixing vulnerabilities
How-tos for reporting and fixing vulnerabilities
How-tos for reporting vulnerabilities
How-tos for fixing vulnerabilities
How-tos for viewing and interpreting security results
How-tos for analyzing security data for an organization
Viewing code scanning logs
Viewing Dependabot job logs
Metrics for custom patterns
Changing the "used by" data for a repository