What is CodeQL and how is it used in GAS?

• A. CodeQL is a runtime security scanner that monitors applications in production.
• B. CodeQL is GitHub's static analysis engine that runs queries to identify code weaknesses, and its results drive Code Scanning alerts.
• C. CodeQL is a database for storing code metrics used in dependency graphs.
• D. CodeQL is a tool for automatically fixing detected vulnerabilities.

Answer: (B)

CodeQL is GitHub’s static analysis engine. It analyzes source code by running queries against a CodeQL database built from the repository, letting you describe patterns that indicate security weaknesses or other issues. In GitHub Advanced Security, CodeQL queries identify potential problems and their findings are surfaced as Code Scanning alerts, shown in pull requests and the Security tab for easy triage. This is not a runtime scanner or a code metrics database, and it doesn’t automatically fix issues; instead, it provides the detection capabilities you use to spot and remediate vulnerabilities and quality problems during development.