GitHub has launched a machine learning-powered code scanning analysis feature to remove the common security vulnerabilities before it moves to production. The scanner will detect patterns like cross-site scripting (XSS), path injection, NoSQL injection and SQL injection. The feature is now available in public beta.
"Together, these four vulnerability types account for many of the recent vulnerabilities (CVEs) in the JavaScript/TypeScript ecosystem, and improving code scanning's ability to detect such vulnerabilities early in the development process is key in helping developers write more secure code,” according to the official blog.
GitHub’s code scanner uses the CodeQL analysis engine. The open source queries are written by members of the community and GitHub security experts. If any vulnerabilities are flagged, an alert pops up in the Security tab. The alerts will have an ‘Experimental’ label, and will also be shown in the Pull Requests tab.
The new experimental analysis can have a higher false-positive rate relative to results from standard CodeQL analysis. But the results will improve over time.
- AI Productivity to Add $28 Billion to $84 Billion to India's GDP: Cognizant Study
- OpenAI's Codex Helps in Aerodynamic Engineering for Mazda
- Bengaluru Accounts for 34% of India's FDE Talent: Report
- 84% See AI Productivity Gains, but Only 10% Allow Agent Autonomy: TCS Study
- Snowflake Introduces Business Ontology, Cortex AI Gateway to Bring AI Agents Into Enterprise Workflows
- Three Members Behind Claude Code Leave Anthropic Within 10 Days