This directory contains comprehensive guides and resources for GitHub Advanced Security Code Scanning and CodeQL.

Security framework and vulnerability catalog mappings for CodeQL queries:

• codeql/actions - GitHub full built-in CodeQL query list / CWE / CVSS Severity Mapping - download the attached code-scanning-query-list.csv artifact from the latest workflow run.
• OWASP Top 10 2025 - Mapping between OWASP Top 10 2025 vulnerabilities and CodeQL queries via CWE identifiers
• MITRE Top 10 KEV - Mapping between MITRE Top 10 Known Exploited Vulnerabilities and CodeQL queries
• SANS Top 25 - Mapping between SANS Top 25 Software Errors and CodeQL queries

• Setup CodeQL CLI - Guide for setting up the CodeQL CLI
• Uploading PR Analysis - How to upload CodeQL analysis results for pull requests
• Sandwich Tracing - Advanced CodeQL tracing techniques

• Third-Party Integrations - Integrating Code Scanning with third-party tools

Test applications for validating CodeQL and Code Scanning:

• OWASP WebGoat - Deliberately insecure web application for testing
• OWASP Juice Shop - Modern vulnerable web application

1. If you're looking for security framework mappings (OWASP, MITRE KEV, SANS), start with the CodeQL Mappings directory
2. For setting up CodeQL, see the Setup CodeQL CLI guide
3. To test CodeQL rules, check out the Synthetic Applications directory

For more Advanced Security resources, see the parent repository's README.