GitHub has announced the general availability of their new code scanning capability, which they say is a developer-first approach for finding security vulnerabilities before they reach production.
According to the GitHub blog, code scanning:
- Integrates with GitHub Actions or your existing CI/CD environment.
- Scans code as it is created.
- Surfaces actionable security reviews within pull requests.
- Automates security as a part of your workflow.
“Instead of overwhelming you with linting suggestions, code scanning runs only the actionable security rules by default so that you can stay focused on the task at hand,” the announcement states.
The code scanning capability is powered by the CodeQL code analysis engine, which lets you use the 2,000+ CodeQL queries created by GitHub and the community or create your own custom queries.
Comments