docs/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md

title, intro, product, versions, type, topics

title	intro	product	versions	type	topics
About code scanning alerts	Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.	{% data reusables.gated-features.code-scanning %}	fpt ghes ghae ghec * * * *	overview	Advanced Security Code scanning CodeQL

{% data reusables.code-scanning.beta %} {% data reusables.code-scanning.enterprise-enable-code-scanning %}

About alerts from {% data variables.product.prodname_code_scanning %}

You can set up {% data variables.product.prodname_code_scanning %} to check the code in a repository using the default {% data variables.product.prodname_codeql %} analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by {% data variables.product.company_short %}'s default {% data variables.product.prodname_codeql %} analysis. For more information, see "Setting up {% data variables.product.prodname_code_scanning %} for a repository."

By default, {% data variables.product.prodname_code_scanning %} analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests."

About alert details

Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, security severity,{% endif %} and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {% data variables.product.prodname_codeql %} analysis, you will also see information on how to fix the problem.

If you set up {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.

When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.

About severity levels

Alert severity levels may be Error, Warning, or Note.

If {% data variables.product.prodname_code_scanning %} is enabled as a pull request check, the check will fail if it detects any results with a severity of error. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}You can specify which severity level of code scanning alerts causes a check failure. For more information, see "Defining the severities causing pull request check failure."{% endif %}

{% ifversion fpt or ghes > 3.1 or ghae or ghec %}

About security severity levels

{% data variables.product.prodname_code_scanning_capc %} displays security severity levels for alerts that are generated by security queries. Security severity levels can be Critical, High, Medium, or Low.

To calculate the security severity of an alert, we use Common Vulnerability Scoring System (CVSS) data. CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities, and is commonly used by other security products to score alerts. For more information about how severity levels are calculated, see this blog post.

By default, any {% data variables.product.prodname_code_scanning %} results with a security severity of Critical or High will cause a check failure. You can specify which security severity level for {% data variables.product.prodname_code_scanning %} results should cause a check failure. For more information, see "Defining the severities causing pull request check failure."{% endif %}

About labels for alerts that are not found in application code

{% data variables.product.product_name %} assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.

• Generated: Code generated by the build process
• Test: Test code
• Library: Library or third-party code
• Documentation: Documentation

{% data variables.product.prodname_code_scanning_capc %} categorizes files by file path. You cannot manually categorize source files.

Here is an example from the {% data variables.product.prodname_code_scanning %} alert list of an alert marked as occurring in library code.

On the alert page, you can see that the filepath is marked as library code (Library label).

{% if codeql-ml-queries %}

About experimental alerts

{% data reusables.code-scanning.beta-codeql-ml-queries %}

In repositories that run {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql %} action, you may see some alerts that are marked as experimental. These are alerts that were found using a machine learning model to extend the capabilities of an existing {% data variables.product.prodname_codeql %} query.

Benefits of using machine learning models to extend queries

Queries that use machine learning models are capable of finding vulnerabilities in code that was written using frameworks and libraries that the original query writer did not include.

Each of the security queries for {% data variables.product.prodname_codeql %} identifies code that's vulnerable to a specific type of attack. Security researchers write the queries and include the most common frameworks and libraries. So each existing query finds vulnerable uses of common frameworks and libraries. However, developers use many different frameworks and libraries, and a manually maintained query cannot include them all. Consequently, manually maintained queries do not provide coverage for all frameworks and libraries.

{% data variables.product.prodname_codeql %} uses a machine learning model to extend an existing security query to cover a wider range of frameworks and libraries. The machine learning model is trained to detect problems in code it's never seen before. Queries that use the model will find results for frameworks and libraries that are not described in the original query.

Alerts identified using machine learning

Alerts found using a machine learning model are tagged as "Experimental alerts" to show that the technology is under active development. These alerts have a higher rate of false positive results than the queries they are based on. The machine learning model will improve based on user actions such as marking a poor result as a false positive or fixing a good result.

Enabling experimental alerts

The default {% data variables.product.prodname_codeql %} query suites do not include any queries that use machine learning to generate experimental alerts. To run machine learning queries during {% data variables.product.prodname_code_scanning %} you need to run the additional queries contained in one of the following query suites.

{% data reusables.code-scanning.codeql-query-suites %}

When you update your workflow to run an additional query suite this will increase the analysis time.

- uses: github/codeql-action/init@v1
  with:
    # Run extended queries including queries using machine learning
    queries: security-extended

For more information, see "Configuring code scanning."

Disabling experimental alerts

The simplest way to disable queries that use machine learning to generate experimental alerts is to stop running the security-extended or security-and-quality query suite. In the example above, you would comment out the queries line. If you need to continue to run the security-extended or security-and-quality suite and the machine learning queries are causing problems, then you can open a ticket with {% data variables.product.company_short %} support with the following details.

• Ticket title: "{% data variables.product.prodname_code_scanning %}: removal from experimental alerts beta"
• Specify details of the repositories or organizations that are affected
• Request an escalation to engineering

{% endif %}