What is a key benefit of Code Scanning with CodeQL?

• A. It finds vulnerabilities before they are merged into the codebase through automated scans
• B. It reduces runtime performance
• C. It replaces need for unit tests
• D. It automatically fixes all bugs

Answer: (A)

Static analysis with CodeQL examines code without running it, using specialized queries to spot patterns that indicate security flaws. A primary benefit is that these automated scans can run in CI/CD and flag vulnerabilities before changes are merged, giving developers early visibility and preventing risky code from entering the main branch. CodeQL queries can be tailored to a project’s languages and threat model, making detections relevant and actionable. This approach is not about runtime performance, does not replace unit tests, and does not automatically fix all bugs; it surfaced issues for engineers to address.