CodeQL expands to Swift for mobile code scanning

GitHub Advanced Security is broadening its mobile application coverage with two new Swift-related capabilities. The first is a public beta of code scanning support for Swift, powered by CodeQL. The second, arriving later in June, adds Swift as a supported package ecosystem in the dependency graph, with GitHub-curated security advisories for Swift packages. Once live, Dependabot will be able to alert developers about vulnerable Swift dependencies and open pull requests containing suggested fixes.

Swift support in code scanning is designed to detect language-specific weaknesses before they ship, including path injections, unsafe web view fetches, cryptographic misuse, and other unsafe handling of unsanitized user data. During the beta period, GitHub says coverage of distinct weakness types will increase incrementally. CodeQL now supports C/C++, Java/Kotlin, JS/TS, Python, Ruby, C#, Go, and Swift, giving developers access to nearly 400 checks with a stated emphasis on low false positive rates.

Mobile language momentum

The move follows the November 2022 public beta for Kotlin in code scanning, which has since helped developers fix over 6,000 Kotlin alerts. Together, Kotlin and Swift address the two dominant mobile platform ecosystems—Android and iOS—where the languages have seen strong adoption. For CodeQL’s analysis engine, supporting both languages closes a gap in the security tooling available to mobile development teams.

Bounty program expands to Swift and Kotlin queries

With both mobile languages now in public beta, the GitHub Security Lab has opened its CodeQL Bug Bounty program to researchers submitting queries targeting Swift and Kotlin open source projects. The program is intended to scale community-driven security research across open source, with successful queries finding existing vulnerabilities and helping prevent future ones.

To encourage participation during the beta window, a bonus applies to Swift and Kotlin query submissions through December 1, 2023. The first 10 submissions that score High or Critical receive an additional reward of up to $2,000. Further details are in the FAQ on the bounty page.