0

I'd like to cross-check the vulnerabilities covered by GitHub's CodeQL service and OWASP Top Ten Web Application Security Risks so that I know where the gaps are.

I can't find a list of vulnerabilities covered by CodeQL. Does GitHub publish the list of rules?

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Kye
  • 5,919
  • 10
  • 49
  • 84

1 Answers1

1

The source code of the CodeQL queries is available in the GitHub repository. The documentation also lists the existing queries:

However, which queries (or rather query suites) are run as part of GitHub workflows depends on the configuration of the workflow.

Marcono1234
  • 5,856
  • 1
  • 25
  • 43