Code scanning reaches general availability on GitHub

GitHub has announced the general availability of code scanning, its native security analysis feature. The capability, which emerged from GitHub's acquisition of Semmle a year ago and was first beta-tested at GitHub Satellite in May, is now available for public repositories.

Code scanning is built around the CodeQL analysis engine and is designed to surface only actionable security rules by default, rather than overwhelming developers with general linting feedback. The feature integrates with GitHub Actions or existing CI/CD pipelines, analyzing code as it is written and presenting security reviews directly within pull requests.

The system comes with more than 2,000 CodeQL queries from GitHub and the community, and users can write custom queries to target new or specific security concerns. Code scanning also supports the open SARIF standard, allowing third-party static application security testing (SAST) tools to feed results into the same GitHub-native interface. Multiple scan results can be exported through a single API.

Early adoption numbers

Since the beta launched in May, GitHub reports significant community uptake:

  • Over 12,000 repositories have been scanned 1.4 million times, uncovering more than 20,000 security issues including remote code execution (RCE), SQL injection, and cross-site scripting (XSS) vulnerabilities.
  • Developers fixed 72% of security errors identified in pull requests within the last 30 days, before merging. Industry data indicates fewer than 30% of all flaws are typically fixed one month after discovery.
  • The open-sourced CodeQL query set has received 132 community contributions.
  • More than a dozen open source and commercial security vendors have partnered with GitHub to run CodeQL alongside other SAST, container scanning, and infrastructure-as-code validation tools.

Team feedback

Code scanning is free for public repositories and available through GitHub Advanced Security for Enterprise customers. Early adopters report improved security workflows:

"We chose Advanced Security for its out-of-the-box functionality and the custom functionality that we can build off of. Instead of it taking a full day to find and fix one security issue, we were able to find and fix three issues in the same amount of time."

– Charlotte Townsley, Director of Security Engineering, Auth0

"GitHub allows us to enable security, versus enforcing it. The sooner we can catch vulnerabilities and product issues, the better it is for the company in the long run."

– James Hurley, Director of Developer Services, McKesson Labs

"If Advanced Security reports error issues, the pull request isn't allowed to be merged. If a security issue is found, we're informed immediately. We go over anything GitHub has highlighted, and we make sure that it's resolved before releasing a stable release. For the developer who will press the merge button, it inspires confidence."

– Dimosthenis Kaponis, CTO, Netdata

Enabling code scanning

Public repositories can enable code scanning immediately. Private repositories can access it through GitHub Enterprise with Advanced Security. GitHub also welcomes contributions to its growing list of CodeQL queries to help secure the broader open source ecosystem.