Tag archive
CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.
GitHub shipped a Mitigated dismissal reason on 20 August 2026 that its own REST API cannot...
OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.
GitHub code scanning across 500 repos: a 2026 rollout that avoids alert overload Summary....
Code scanning now surfaces AI-powered security detections directly on pull requests, tagged next to CodeQL findings so reviewers can tell them apart. The alerts are informational and never block a merge, but they finally land where reviewers already look.
GitHub's agentic autofix for code scanning alerts is in public preview, expanding remediation from the alert location out to the files around it. For CI/CD teams, a single alert now maps to a codebase-shaped change instead of a one-line patch.
Stop manual code reviews. Start smart, context-aware vulnerability detection in seconds.
The primary goal of many software companies today is to keep end users engaged with their software by...