GitHub's product security team uses CodeQL to detect and prevent vulnerabilities at scale. 🔒 Learn how you can too. ⬇️
github.blog/engineering/...
github.blog/engineering/...
How GitHub uses CodeQL to secure GitHub
How GitHub’s Product Security Engineering team manages our CodeQL implementation at scale and how you can, too.
github.blog
February 21, 2025 at 8:16 PM
GitHub's product security team uses CodeQL to detect and prevent vulnerabilities at scale. 🔒 Learn how you can too. ⬇️
github.blog/engineering/...
github.blog/engineering/...
This is a nice attack on Github and CodeQL and a really detailed writeup. Impressive.
www.praetorian.com/blog/codeqle...
www.praetorian.com/blog/codeqle...
CodeQLEAKED - Public Secrets Exposure Leads toSupply Chain Attack on GitHub CodeQL
An exposed GitHub token could have been used to launch a supply chain attack on GitHub CodeQL, resulting in source code exposure and repository tampering of CodeQL users.
www.praetorian.com
March 31, 2025 at 10:14 AM
This is a nice attack on Github and CodeQL and a really detailed writeup. Impressive.
www.praetorian.com/blog/codeqle...
www.praetorian.com/blog/codeqle...
Announcing #CodeQL Community Packs
https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/
https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/
github.blog
December 24, 2024 at 5:51 AM
Announcing #CodeQL Community Packs
https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/
https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/
"CodeQL detected code written in C# but could not process any of it"
This is not a comment on my code, rather that CodeQL in Github actions is having a hard time with .NET 10 installed.
My temp solution is to have a CodeQL configuration and in Directory.Build.props have a conditional Target.
This is not a comment on my code, rather that CodeQL in Github actions is having a hard time with .NET 10 installed.
My temp solution is to have a CodeQL configuration and in Directory.Build.props have a conditional Target.
November 11, 2025 at 10:30 PM
"CodeQL detected code written in C# but could not process any of it"
This is not a comment on my code, rather that CodeQL in Github actions is having a hard time with .NET 10 installed.
My temp solution is to have a CodeQL configuration and in Directory.Build.props have a conditional Target.
This is not a comment on my code, rather that CodeQL in Github actions is having a hard time with .NET 10 installed.
My temp solution is to have a CodeQL configuration and in Directory.Build.props have a conditional Target.
When your CodeQL query fails, don't get frustrated—get debugging. ⚙️
Here's how to use CodeQL's built-in debugging features, like ASTs and partial path graphs, to diagnose issues fast. ✅
Get the step-by-step guide.👇
Here's how to use CodeQL's built-in debugging features, like ASTs and partial path graphs, to diagnose issues fast. ✅
Get the step-by-step guide.👇
CodeQL zero to hero part 5: Debugging queries
Learn to debug and fix your CodeQL queries.
github.blog
October 16, 2025 at 4:15 PM
When your CodeQL query fails, don't get frustrated—get debugging. ⚙️
Here's how to use CodeQL's built-in debugging features, like ASTs and partial path graphs, to diagnose issues fast. ✅
Get the step-by-step guide.👇
Here's how to use CodeQL's built-in debugging features, like ASTs and partial path graphs, to diagnose issues fast. ✅
Get the step-by-step guide.👇
“CodeQL clean” is so fucking funny dude I’m in tears
March 22, 2026 at 12:01 AM
“CodeQL clean” is so fucking funny dude I’m in tears
No dependabot, bad dependabot, you can’t update codeql bit by bit. You break it.
July 28, 2026 at 2:47 AM
No dependabot, bad dependabot, you can’t update codeql bit by bit. You break it.
CodeQL lets you query your code to find logic errors and security issues that standard text search completely misses.
It allows you to take one bug and automatically find every other place that same pattern exists—so you can fix them all at once.
Ready to try it out yourself? Here's how. ⬇️
It allows you to take one bug and automatically find every other place that same pattern exists—so you can fix them all at once.
Ready to try it out yourself? Here's how. ⬇️
About code scanning with CodeQL - GitHub Docs
You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.
docs.github.com
December 15, 2025 at 9:10 PM
CodeQL lets you query your code to find logic errors and security issues that standard text search completely misses.
It allows you to take one bug and automatically find every other place that same pattern exists—so you can fix them all at once.
Ready to try it out yourself? Here's how. ⬇️
It allows you to take one bug and automatically find every other place that same pattern exists—so you can fix them all at once.
Ready to try it out yourself? Here's how. ⬇️
[RSS] Finding Bugs in Chrome with CodeQL
https://bughunters.google.com/blog/5085111480877056/finding-bugs-in-chrome-with-codeql
Original post
https://bughunters.google.com/blog/5085111480877056/finding-bugs-in-chrome-with-codeql
Original post
November 21, 2024 at 10:26 AM
[RSS] Finding Bugs in Chrome with CodeQL
https://bughunters.google.com/blog/5085111480877056/finding-bugs-in-chrome-with-codeql
Original post
https://bughunters.google.com/blog/5085111480877056/finding-bugs-in-chrome-with-codeql
Original post
Deprecation notice: All-platform CodeQL bundle
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In… The post Deprecation notice: All-platform CodeQL bundle appeared first on The GitHub Blog.
github.blog
September 22, 2026 at 9:53 AM
Deprecation notice: All-platform CodeQL bundle
👀
AI-powered autofixes for historical CodeQL alerts are now in public beta github.blog/changelog/20...
AI-powered autofixes for historical CodeQL alerts are now in public beta github.blog/changelog/20...
AI-powered autofixes for historical CodeQL alerts are now in public beta
AI-powered autofixes for historical CodeQL alerts are now in public beta
github.blog
July 16, 2024 at 9:55 PM
👀
AI-powered autofixes for historical CodeQL alerts are now in public beta github.blog/changelog/20...
AI-powered autofixes for historical CodeQL alerts are now in public beta github.blog/changelog/20...
CodeQL is the static analysis engine behind #GitHub code scanning, which finds and remediates security issues in your code.
CodeQL 2.25.4 adds improvements to #Java.
Full release: github.blog/changelog/20...
CodeQL 2.25.4 adds improvements to #Java.
Full release: github.blog/changelog/20...
June 4, 2026 at 7:42 PM
CodeQL is the static analysis engine behind #GitHub code scanning, which finds and remediates security issues in your code.
CodeQL 2.25.4 adds improvements to #Java.
Full release: github.blog/changelog/20...
CodeQL 2.25.4 adds improvements to #Java.
Full release: github.blog/changelog/20...
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find… The post CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support appeared first on The GitHub Blog.
github.blog
September 25, 2026 at 11:29 AM
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as…
https://changeradar.ai/tools/github
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as…
https://changeradar.ai/tools/github
September 22, 2026 at 12:02 PM
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as…
https://changeradar.ai/tools/github
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as…
https://changeradar.ai/tools/github
NEWS! #raylib is going through a security audit in the following months by Radically Open Security team! 🚀
First time going through a professional security audit (beside the CodeQL static analysis engine from GitHub). Let's see how it goes! Really exciting! 😄
First time going through a professional security audit (beside the CodeQL static analysis engine from GitHub). Let's see how it goes! Really exciting! 😄
November 26, 2025 at 11:37 AM
NEWS! #raylib is going through a security audit in the following months by Radically Open Security team! 🚀
First time going through a professional security audit (beside the CodeQL static analysis engine from GitHub). Let's see how it goes! Really exciting! 😄
First time going through a professional security audit (beside the CodeQL static analysis engine from GitHub). Let's see how it goes! Really exciting! 😄
I’m shocked. Shocked that US AI might be heavily overvalued and overhyped.
That being said, DeepSeek is actually very impressive so far with my testing on security engineering and obscure stuff like CodeQL queries.
That being said, DeepSeek is actually very impressive so far with my testing on security engineering and obscure stuff like CodeQL queries.
January 27, 2025 at 4:18 PM
I’m shocked. Shocked that US AI might be heavily overvalued and overhyped.
That being said, DeepSeek is actually very impressive so far with my testing on security engineering and obscure stuff like CodeQL queries.
That being said, DeepSeek is actually very impressive so far with my testing on security engineering and obscure stuff like CodeQL queries.
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
https://github.blog/changelog/2026-09-25-codeql-2-27-1-adds-c-and-c-query-and-kotlin-2-4-20-support
https://github.blog/changelog/2026-09-25-codeql-2-27-1-adds-c-and-c-query-and-kotlin-2-4-20-support
September 25, 2026 at 2:55 PM
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
https://github.blog/changelog/2026-09-25-codeql-2-27-1-adds-c-and-c-query-and-kotlin-2-4-20-support
https://github.blog/changelog/2026-09-25-codeql-2-27-1-adds-c-and-c-query-and-kotlin-2-4-20-support
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
September 25, 2026 at 11:18 AM
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
Deprecation notice: All-platform CodeQL bundle
https://github.blog/changelog/2026-09-22-deprecation-notice-all-platform-codeql-bundle
https://github.blog/changelog/2026-09-22-deprecation-notice-all-platform-codeql-bundle
September 22, 2026 at 11:30 AM
Deprecation notice: All-platform CodeQL bundle
https://github.blog/changelog/2026-09-22-deprecation-notice-all-platform-codeql-bundle
https://github.blog/changelog/2026-09-22-deprecation-notice-all-platform-codeql-bundle
We wanted to make it easier for security researchers to get started with static analysis against Chromium, so we're publishing CodeQL databases you can download and query against. We build these daily and we also build a smaller db just for V8.
Happy hunting!
bughunters.google.com/blog/5085111...
Happy hunting!
bughunters.google.com/blog/5085111...
Blog: Finding Bugs in Chrome with CodeQL
Want to learn about using a static analysis tool called CodeQL to search for vulnerabilities in Google Chrome? Then this blog post is for you!
bughunters.google.com
November 22, 2024 at 12:22 AM
We wanted to make it easier for security researchers to get started with static analysis against Chromium, so we're publishing CodeQL databases you can download and query against. We build these daily and we also build a smaller db just for V8.
Happy hunting!
bughunters.google.com/blog/5085111...
Happy hunting!
bughunters.google.com/blog/5085111...
Good to see CodeQL adding C/C++ query support! That's a huge win for catching potential vulnerabilities in those legacy, memory-heavy projects. Plus, Kotlin 2.4.20 support keeps things current. Less late-night debugging, hopefully. #DevSecOps #CodeQL
September 25, 2026 at 11:19 AM
Good to see CodeQL adding C/C++ query support! That's a huge win for catching potential vulnerabilities in those legacy, memory-heavy projects. Plus, Kotlin 2.4.20 support keeps things current. Less late-night debugging, hopefully. #DevSecOps #CodeQL
🚀 CodeQL zero to hero part 4: Gradio case study is out! This time we dive into how I wrote CodeQL to support the @hf.co's Gradio framework, scaled the research to a thousand repositories on GitHub, and found 11 vulnerabilities.
gh.io/codeql-part-4
gh.io/codeql-part-4
CodeQL zero to hero part 4: Gradio framework case study
Learn how I discovered 11 new vulnerabilities by writing CodeQL models for Gradio framework and how you can do it, too.
gh.io
December 11, 2024 at 6:59 PM
🚀 CodeQL zero to hero part 4: Gradio case study is out! This time we dive into how I wrote CodeQL to support the @hf.co's Gradio framework, scaled the research to a thousand repositories on GitHub, and found 11 vulnerabilities.
gh.io/codeql-part-4
gh.io/codeql-part-4
Dev update 🚧
stabilized GitHub workflows (branch rules + free tier), fixed post-billing failures, improved CodeQL setup, and added stronger publishing guards + safety checks.
Now adding lint + CodeQL + release automation for more reliable deployments.
ascendant-continuum.web.app/%E2%81%A0
stabilized GitHub workflows (branch rules + free tier), fixed post-billing failures, improved CodeQL setup, and added stronger publishing guards + safety checks.
Now adding lint + CodeQL + release automation for more reliable deployments.
ascendant-continuum.web.app/%E2%81%A0
https://ascendant-continuum.web.app/
May 25, 2026 at 9:22 PM
Dev update 🚧
stabilized GitHub workflows (branch rules + free tier), fixed post-billing failures, improved CodeQL setup, and added stronger publishing guards + safety checks.
Now adding lint + CodeQL + release automation for more reliable deployments.
ascendant-continuum.web.app/%E2%81%A0
stabilized GitHub workflows (branch rules + free tier), fixed post-billing failures, improved CodeQL setup, and added stronger publishing guards + safety checks.
Now adding lint + CodeQL + release automation for more reliable deployments.
ascendant-continuum.web.app/%E2%81%A0