GitHub Advanced Security key terms

GitHub's semantic code analysis engine that compiles a database from source and runs queries against it to find security vulnerabilities. It powers CodeQL code scanning in GitHub Advanced Security.

An indexed, queryable representation of a codebase produced during extraction. Queries run against this database rather than raw files, enabling cross-file data-flow analysis during code scanning.

A versioned bundle of CodeQL queries and dependencies distributed for use in analysis. Packs let teams pin query suites and reuse shared query libraries across repositories.

A named selection of CodeQL queries (for example a security-and-quality set) that defines which checks run in a code scanning analysis. Suites can be customized to include or exclude queries.

GitHub Advanced Security feature that runs static analysis on repository code and reports alerts. It surfaces CodeQL or third-party SARIF results as reviewable alerts on pull requests and the security tab.

Static Analysis Results Interchange Format, a JSON standard for reporting static analysis findings. Code scanning ingests SARIF uploads from third-party tools so their results appear as GitHub alerts.

A finding created when a code scanning analysis detects a potential vulnerability. Alerts have states, severity, locations, and can be dismissed with a documented reason.

Technique that tracks how values move from a source (such as user input) to a sink (such as a database query). CodeQL uses it to detect injection and taint-style vulnerabilities.

A form of data flow analysis that follows untrusted input through assignments and function calls, marking values as tainted until sanitization occurs. It is central to injection detection.

In security queries, a source is where untrusted data enters (like an HTTP parameter) and a sink is a dangerous operation (like SQL execution). Queries flag paths connecting them.

A function or check that neutralizes untrusted input, such as escaping HTML or parameterizing a query. Taint tracking stops propagation when a value passes through a recognized sanitizer.

GitHub Advanced Security feature that detects credentials such as API keys and tokens committed to repositories. It alerts maintainers and can notify the secret's provider for revocation.

A secret scanning control that blocks a push containing a detected secret before it reaches the repository. Developers can bypass with a documented reason if permitted by policy.

A user-defined regular expression that extends secret scanning to organization-specific credentials not covered by default detectors. Patterns are configured at the organization or enterprise level.

A record generated when secret scanning finds a credential in a repository. Alerts track validity, resolution state, and whether the secret was revoked or deemed a false positive.

A secret scanning capability that tests whether a detected credential is still active by contacting the provider. Valid secrets are prioritized for immediate revocation.

The justification a developer must supply when pushing past push protection. Reasons such as false positive or used in tests are recorded and reported to security teams.

Notifications that a repository depends on a package with a known vulnerability listed in the GitHub Advisory Database. Alerts include severity, affected versions, and patched versions.

Automated pull requests that upgrade a vulnerable dependency to a fixed version. They are triggered by Dependabot alerts and reduce manual remediation effort.

GitHub's inventory of a repository's direct and transitive dependencies, built from manifest and lock files. It underpins Dependabot alerts and dependency review.

A pull request check that reports vulnerable or license-restricted dependencies introduced by the change. It blocks merges when findings exceed configured thresholds.

A curated database of security advisories for open source packages, including CVE and GitHub-reviewed entries. Dependabot and dependency review draw vulnerability data from it.

A published notice describing a vulnerability, affected versions, and remediation. Repository maintainers can draft advisories privately and publish them to coordinate disclosure.

Common Vulnerabilities and Exposures, a standardized identifier for a publicly known security flaw. GitHub advisories often map to CVE IDs, linking them to industry databases.

A machine-readable inventory of components and dependencies in a project. GitHub can export SBOMs from the dependency graph for supply chain transparency and compliance.

An organization and enterprise dashboard summarizing code scanning, secret scanning, and Dependabot alert status across repositories. It supports risk prioritization and coverage tracking.

A reusable set of GitHub Advanced Security enablement settings, such as which features are on and default query suites. Configurations are applied to many repositories at once.

A low-configuration code scanning option where GitHub automatically selects languages, query suites, and triggers. It removes the need to author a custom Actions workflow.

A code scanning configuration where a workflow file defines languages, build steps, and queries explicitly. It supports custom compilation and scheduled or event-specific triggers.

An organization role granting read access to security alerts and settings across repositories without full administrative rights. It lets security staff triage findings without code write access.

The lifecycle status of a security alert, typically open, dismissed, or fixed. States drive metrics and filtering in the security overview and API.

A categorized justification recorded when closing an alert, such as false positive, won't fix, or used in tests. Reasons enable auditing and tuning of detection rules.

A coordinated effort to remediate a class of alerts across many repositories, with tracked progress and targeted developer guidance. Campaigns help reduce large alert backlogs.

A YAML-defined automation that runs jobs on events. Code scanning and dependency review rely on workflows to trigger analysis and upload results.

The process of submitting SARIF output from an external scanner to code scanning using an upload action or API. Results then appear as native GitHub alerts.

A dependency review setting that flags or blocks dependencies whose licenses violate organizational rules. It helps enforce open source compliance during pull requests.

A process where maintainers privately develop and publish a security advisory before publicizing a vulnerability, giving users time to upgrade. GitHub supports private advisory drafting.