#code-scanning
Tagged “code-scanning”
4 articlesCodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module
CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.
Aug 23, 2026 · Maya OkonkwoSecurity & supply chainOpenAI open-sources the Codex Security CLI and keeps the scanner in-house
OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.
Jul 30, 2026 · Tomás VegaDeveloper experienceGitHub tags AI-generated code scanning alerts on the PR itself
Code scanning now surfaces AI-powered security detections directly on pull requests, tagged next to CodeQL findings so reviewers can tell them apart. The alerts are informational and never block a merge, but they finally land where reviewers already look.
Jul 16, 2026 · Priya NairDeveloper experienceAutofix that reads more than one file: GitHub previews agentic code scanning fixes
GitHub's agentic autofix for code scanning alerts is in public preview, expanding remediation from the alert location out to the files around it. For CI/CD teams, a single alert now maps to a codebase-shaped change instead of a one-line patch.
Jul 14, 2026 · Priya Nair