What are the recommended language coverage and scanning frequency for CodeQL in a typical GitHub repository using GAS?

• A. Cover a subset of languages and run scans monthly
• B. Only scan on PRs
• C. Cover all languages used; run scans on push and PRs (and nightly if possible)
• D. Disable nightly scans

Answer: (C)

Cover all languages used in the repository so CodeQL can analyze every part of the codebase, not just a subset. Running scans on push ensures each new commit is examined for vulnerabilities right away, while scanning on pull requests checks the changes being proposed before they’re merged, catching issues early in the review process. If possible, enabling nightly scans adds a valuable safety net, catching problems that can arise from dependency updates or files that change indirectly, even when there isn’t a new push or PR that day. This approach minimizes gaps in detection and keeps security visibility high across the entire codebase.