What best describes the primary technique used by CodeQL to identify vulnerabilities?

• A. Dynamic analysis at runtime
• B. Querying code as data to identify vulnerabilities
• C. Compiling to a different language for analysis
• D. Only checking coding style

Answer: (B)

Querying code as data is how CodeQL finds vulnerabilities. It first builds a code database from your repository, capturing facts about syntax, control flow, data flow, and API usage. You then write CodeQL queries that navigate these facts to spot risky patterns, such as tainted input reaching a sensitive operation without proper validation. Because this is static analysis, CodeQL can scan large codebases without running the program, and it can detect issues across languages by querying the prepared code facts. This approach differs from dynamic analysis, which executes the program to observe behavior, and from anything that merely checks coding style or relies on translating code into another language for analysis.