🧰 CodeQL

The items that name it 20

• Building your AI vulnerability harness, Part 1
  articleas tools2026-10-07

  Static scanner used as equivalent tooling to Semgrep for multi-scanner triage

• Common C/C++ Vulnerabilities: A Practical Guide to Prevention | Blog | Endor Labs
  articleas tools2026-09-11

  leading SAST tool for C/C++

• LiteLLM
  toolas tools2026-08-31It is written here as CodeQL: code scanning on the codebase.
• DocsGPT Security Hardening Playbook
  writeupas tools2026-08-15It is written here as CodeQL (custom queries).

  Inventories every untrusted-input point and dangerous sink in the codebase so new attack surface must be consciously allow-listed

• SecureAI-Scan
  repoas tools2026-08-05

  Independent CI check used on the SecureAI-Scan project itself

• AI code security harnesses compared
  articleas tools2026-07-24

  Deterministic program analysis tool used as input to guide LLM search space in several hybrid harnesses (e.g. raptor, trailofbits/skills static-analysis)

• Argo
  repoas tools2026-07-18

  rule-based static analyzer, contrasted with Argo's LLM-native approach

• SreeragPramod/securepipe
  repoas tools2026-07-15

  Proposed future addition for GitHub's semantic code analysis to find deeper vulnerabilities beyond pattern matching

• Unauthenticated RCE in ArgoCD
  writeupas tools2026-07-11

  static code analysis / data flow (taint) tracking tool used by Synacktiv to identify RemoteFlowSources and command-injection sinks in the Argo CD Golang codebase, using custom queries and model packs

• Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Blog | Endor Labs
  articleas classification.technologies2026-07-06
• StepSecurity Maintained Actions Are Now Free for Public Repos
  articleas tools2026-07-02

  Required passing security status check before merge in StepSecurity's maintained action branch protection process

• RAPTOR
  repoas tools2026-06-28

  Optional but recommended static analysis; interprocedural taint tracking, 8 custom queries for C++ (format string injection, integer truncation, use-after-move, iterator invalidation) and Java (XXE, insecure deserialisation, log injection, Spring SSRF); licence does not permit commercial use

• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas tools2026-05-20

  Internal code scanning tooling referenced among leaked internal repos (codeql-docs, codeql-team, code-scanning)

• 0xor0ne Awesome List
  repoas tools2026-05-12

  Static analysis / code querying, practical introduction

• Mythos AI Security Testing
  articleas tools2026-05-12

  Static code analyzer cited as part of curl's existing audit tooling

• PyPI Access Control Vulns Patched
  articleas tools2026-05-06

  Trail of Bits developed a custom CodeQL query to detect cases where state-changing POST handlers are protected only by read-level permissions

• OWASP Free AppSec Tools
  articleas classification.technologies2026-05-06
• 973 MCP Packages, 71% Single-Maintainer: A Practitioner
  articleas toolsIt is written here as CodeQL (SAST).

  SAST

• Securely using pull_request_target - GitHub Enterprise Cloud Docs
  articleas classification.technologies
• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repoas tools

  GitHub code scanning tool; ChainDrop plants a fake codeql_analysis.yml workflow to exfiltrate secrets via toJSON(secrets).

In every workspace you can read 22