What is the function of GitHub's code scanning feature?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Code scanning is your automated security engineer. It runs static analysis tools like CodeQL against your codebase looking for vulnerabilities — SQL injection, XSS, buffer overflows — the stuff that causes real-world breaches.
Full explanation below image
Full Explanation
GitHub Code Scanning is a static application security testing (SAST) feature that analyzes source code for security vulnerabilities and coding errors. It integrates with CodeQL (GitHub's code analysis engine) and third-party SAST tools via the SARIF format. Code scanning results appear as alerts in the Security tab and as annotations on pull requests. It does NOT check for syntax errors (that's a compiler/linter), does NOT check for code review completion (that's branch protection), and does NOT specifically focus on hardcoded secrets (that's secret scanning — a separate feature). Code scanning focuses on logic-level security vulnerabilities like injection flaws, unsafe deserialization, and authentication bypasses.