What is CodeQL in the context of GitHub Advanced Security, and what is its primary purpose?

• A. CodeQL is GitHub's static analysis engine that analyzes code by querying it as data to identify security vulnerabilities across languages and code patterns.
• B. A runtime engine that executes code.
• C. A code formatter tool.
• D. A code editor plugin.

Answer: (A)

CodeQL is GitHub's static analysis engine that treats code as data. It converts source code into a structured database of facts about the code (like its structure, data flows, and control flows) and lets you write queries in the CodeQL language to search for patterns that indicate security vulnerabilities. The primary purpose is to enable scalable, language-agnostic detection of security issues by expressing and executing queries that reveal risky code patterns across many languages, both with built-in queries and custom ones you can write. It’s not a runtime engine, a formatter, or a code editor plugin; its strength lies in analyzing code without executing it, so you can find potential flaws before they become exploitable.