Which statement accurately describes the purpose of CodeQL within GitHub Advanced Security?

• A. It is GitHub's static analysis engine that analyzes code by querying it as data to identify security vulnerabilities across languages and code patterns.
• B. It is a runtime testing framework for performance optimization.
• C. It is a UI component for issue tracking.
• D. It is a database migration tool.

Answer: (A)

CodeQL is GitHub Advanced Security's static analysis tool that analyzes code by querying it as data to identify security vulnerabilities across languages and code patterns. It works by turning source code into a searchable code database that captures structure, data flow, and control flow, then running CodeQL queries—specialized patterns written in the CodeQL language—to detect potential security issues. Because this is static analysis, the code isn’t executed; instead, the tool looks for suspicious patterns and relationships across the codebase, across multiple languages, and surfaces findings as alerts you can review and remediate. This is different from runtime testing, UI components, or migration tools, which are not what CodeQL provides.