Issues · github/codeql · GitHub

Labels Milestones New issue

Should `java/trust-boundary-violation` recognize regex validation guards?

#21655

· MarkLee131 opened

on Apr 4, 2026

`java/sensitive-log`: missing sanitizer for hashed/encrypted data

#21653

· MarkLee131 opened

on Apr 4, 2026

False positive: in`java/path-injection`,`Path.toRealPath()` not recognized as sanitizer

#21651

· MarkLee131 opened

on Apr 4, 2026

False positive: `java/sensitive-log` overly broad variable name regex causes widespread false positives

#21649

· MarkLee131 opened

on Apr 4, 2026

Incomplete naming schema and API usage patterns in py/insecure-cookie

#21647

· tacu22 opened

on Apr 3, 2026

Support for `.razor` files is unclear

#21645

· Frulfump opened

on Apr 3, 2026

Add AlertSuppression.ql for Rust (inline // codeql[...] suppression)

#21637

· christiannuss-ybor opened

on Apr 2, 2026

False positive for actions/missing-workflow-permissions on reusable workflow files

#21629

· Lawls91 opened

on Apr 1, 2026

C++: Model taint flow through pointer-returning methods using MaD summaries

#21623

· hello123leo opened

on Mar 31, 2026

py/HardcodedCredentials misses common credential patterns and flags usernames.

#21620

· 9iang22 opened

on Mar 31, 2026

False negatives of `py/flask-debug`

#21616

· 9iang22 opened

on Mar 30, 2026

False positive: `java/zipslip` flags archive entry names used for class loading, not file extraction

#21606

· MarkLee131 opened

on Mar 28, 2026