GitHub 21 🌐 GitHub Secret Scanning and CodeQL Analysis - KandZ

⏱️ Estimated read: 8 min | |

GitHub provides two distinct static analysis security features: Secret Scanning, which detects leaked credentials in code and text, and CodeQL Analysis, which performs semantic code analysis to find vulnerabilities like SQL injection or cross-site scripting. A critical change occurred in May 2025: CodeQL no longer detects hardcoded secrets. Secret Scanning is now the sole mechanism for credential detection, offering higher accuracy and eliminating duplicate alerts between the two tools .

Key point: Secret Scanning catches leaked API keys and tokens (including in Git history and issues), while CodeQL traces data flow to find logic flaws. They are complementary, but their responsibilities are strictly separated: CodeQL no longer looks for secrets.

Why Secret Scanning and CodeQL exist

The credential leak problem. Committing an API key or a database password is one of the most common security mistakes. Secret Scanning scans the entire Git history, issues, pull requests, and wikis for known secret patterns (over 300 providers). If a secret is detected, it generates an alert. Push Protection goes further, blocking the commit from ever reaching the repository .

The semantic vulnerability problem. Linters find style issues; Secret Scanning finds keys. Neither finds a SQL injection vulnerability that spans multiple files. CodeQL treats code as a queryable database, building an abstract syntax tree and data-flow graph to trace how untrusted input reaches sensitive functions (like a database query). This is semantic analysis, not pattern matching .

The product split problem. In 2025, GitHub split Advanced Security (GHAS) into two purchasable products: GitHub Code Security (for CodeQL) and GitHub Secret Protection (for Secret Scanning and Push Protection). For public repositories, basic Secret Scanning and CodeQL are free. For private repositories, you need the respective license .

The noise problem. Before May 2025, both CodeQL and Secret Scanning could detect a hardcoded password, creating two alerts for the same issue. GitHub disabled the CodeQL queries for hardcoded secrets to consolidate alert management into a single, more accurate tool .

The trade-off. CodeQL is powerful but slow. Building the database and running queries can take 20–40 minutes for large codebases. Secret Scanning is fast but only finds secrets it has patterns for (though custom patterns can be defined) .

a. Configuring Secret Scanning and Push Protection

Secret Scanning must be enabled in the repository settings. Push Protection is a separate toggle that blocks commits at the command line or web interface.

Settings → Advanced Security → Secret Protection → Enable
Settings → Advanced Security → Push protection → Enable

When Push Protection is active and you attempt to push a commit containing a secret, the push is rejected with an error. You have three options:

Remove the secret from the commit (using git commit --amend or git rebase -i) .
Bypass the protection by clicking a link in the error message and providing a reason (e.g., “used in tests”) .
If delegated bypass is enabled, request permission from a security manager.

You can exclude specific directories (like test/fixtures/) from scanning using a .github/secret_scanning.yml file with a paths-ignore list .

b. Setting up CodeQL Analysis

CodeQL runs via GitHub Actions. The easiest setup is the Default configuration, which automatically selects the languages and triggers. For more control, use Advanced setup, which generates a codeql.yml workflow file.

name: CodeQL
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '30 6 * * 1' # Weekly

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      matrix:
        language: [ 'javascript-typescript' ]
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
      - uses: github/codeql-action/analyze@v4

The security-events: write permission is required to upload the SARIF results to GitHub . The queries: security-extended option runs more queries than the default suite.

For compiled languages (C/C++, Java), you may need to specify a build-mode. autobuild attempts to build automatically; manual allows you to insert custom build commands .

Complete Example Session

# ============================================
# PART 1: ENABLE SECRET SCANNING
# ============================================

# Settings → Advanced Security → Secret Protection → Enable
# This scans the entire history for known secret patterns.

# ============================================
# PART 2: ENABLE PUSH PROTECTION
# ============================================

# Settings → Advanced Security → Push protection → Enable

# ============================================
# PART 3: TEST PUSH PROTECTION
# ============================================

# Create a file with a fake AWS key:
echo "aws_access_key_id = AKIAIOSFODNN7EXAMPLE" > test.txt
git add test.txt
git commit -m "Add test file"
git push
# The push is blocked by Push Protection.

# ============================================
# PART 4: BYPASS PUSH PROTECTION
# ============================================

# Follow the link in the error message.
# Select "It's used in tests" as the reason.
# Re-push within 3 hours.
# An alert is created and auto-closed.

# ============================================
# PART 5: CONFIGURE CODEQL DEFAULT SETUP
# ============================================

# Settings → Code security and analysis
# CodeQL analysis → Set up → Default
# GitHub creates the workflow automatically.

# ============================================
# PART 6: VIEW CODEQL ALERT
# ============================================

# Security → Code scanning alerts
# Click an alert to see the data flow path.
# Copilot Autofix may suggest a patch.

# ============================================
# PART 7: CONFIGURE ADVANCED SETUP
# ============================================

# Settings → Code security and analysis
# CodeQL analysis → Set up → Advanced
# A codeql.yml file is generated.
# Commit it to the repository.

# ============================================
# PART 8: ADD CUSTOM SECRET PATTERN
# ============================================

# Settings → Advanced Security → Secret Protection
# Custom patterns → New pattern
# Define a regex for your internal API key format.

# ============================================
# PART 9: REVIEW ALERTS
# ============================================

# Security tab → Secret scanning alerts
# Security tab → Code scanning alerts
# Each alert links to the location and provides remediation guidance.

Quick Reference

Secret Scanning vs CodeQL

Feature	Secret Scanning	CodeQL
Detects	Credentials (keys, tokens)	Vulnerabilities (injection, XSS)
Method	Pattern matching	Semantic data-flow analysis
Speed	Fast	Slow (20–40 min for large repos)
Push Protection	Yes	No
Public Repo	Free (basic)	Free
Private Repo	Requires Secret Protection	Requires Code Security

Secret Scanning Configuration

Setting	Location
Enable Secret Protection	Settings → Advanced Security
Enable Push Protection	Settings → Advanced Security
Exclude paths	`.github/secret_scanning.yml`
Custom patterns	Settings → Advanced Security

CodeQL Configuration

Option	Value
Workflow file	`.github/workflows/codeql.yml`
Required permission	`security-events: write`
Default query suite	`security-extended`
Build modes	`none`, `autobuild`, `manual`

Best Practices

✅ Do This:

permissions:
  security-events: write
<!-- Required for CodeQL to upload results -->        # ✅

# Enable Push Protection
<!-- Blocks secrets before they enter the repository --> # ✅

# Use custom patterns for internal API keys
<!-- Detects secrets specific to your organization --> # ✅

❌ Don’t Do This:

# Rely on CodeQL to find secrets
<!-- CodeQL no longer detects hardcoded secrets -->   # ❌

# Ignore a Secret Scanning alert
<!-- The credential is compromised; revoke it -->     # ❌

# Skip the security-events permission
<!-- CodeQL analysis cannot upload results -->        # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
CodeQL not finding secrets	Feature was removed	Use Secret Scanning instead
Push Protection blocks push	Secret detected	Remove secret or bypass with reason
CodeQL workflow fails	Missing permissions	Add `security-events: write`
Secret alert on test file	Secret is fake but matches pattern	Exclude path or bypass
No alerts on private repo	License not enabled	Purchase Secret Protection or Code Security

Real-World Examples

1. Enable Secret Protection

Settings → Advanced Security → Secret Protection

2. Enable Push Protection

Settings → Advanced Security → Push protection

3. Exclude Path

# .github/secret_scanning.yml
paths-ignore:
  - "test/fixtures/**"

4. CodeQL Workflow

uses: github/codeql-action/init@v4

5. Query Suite

queries: security-extended

6. Bypass Push Protection

Click link → Select reason → Allow push

7. View Secret Alert

Security → Secret scanning alerts

8. View CodeQL Alert

Security → Code scanning alerts

9. Custom Pattern

Settings → Advanced Security → Custom patterns

10. Copilot Autofix

Code scanning alert → Generate fix

Visual

Security Tool Responsibilities

┌──────────────────────────────────────────────┐
│  SECRET SCANNING                             │
│  ├── API keys, tokens, passwords            │
│  ├── Scans Git history, issues, PRs         │
│  ├── Push Protection blocks commits         │
│  └── No code analysis                       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  CODEQL                                      │
│  ├── SQL injection, XSS, path traversal     │
│  ├── Data-flow analysis                     │
│  ├── No secret detection (since May 2025)   │
│  └── Slow but deep                          │
└──────────────────────────────────────────────┘

The split is deliberate: credentials are pattern-matched, vulnerabilities are semantically analyzed.

Push Protection Flow

git push
    │
    ▼
┌──────────────────────────────────────────────┐
│  Secret detected in commit?                  │
│  ├─ NO  → Push succeeds                      │
│  └─ YES → Push blocked                       │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Bypass options:                             │
│  ├─ Remove secret and amend commit           │
│  ├─ Bypass with reason (alert auto-closed)   │
│  └─ Request delegated bypass                 │
└──────────────────────────────────────────────┘

Push Protection prevents the secret from ever entering the repository.

Summary

Item	Value
Secret Scanning	Finds credentials
CodeQL	Finds vulnerabilities (not secrets)
Push Protection	Blocks secrets at push time
CodeQL permission	`security-events: write`
CodeQL workflow	`.github/workflows/codeql.yml`
Secret exclusions	`.github/secret_scanning.yml`
Public repo	Free (basic)
Private repo	Requires license

Key takeaways:

Secret Scanning and CodeQL have different jobs. Secret Scanning finds leaked credentials. CodeQL finds semantic vulnerabilities like injection flaws. Since May 2025, CodeQL no longer detects hardcoded secrets .
Push Protection is the strongest defense. It blocks the secret before it ever enters the repository. Bypassing it requires a deliberate action and creates an alert .
CodeQL needs the right permission. The workflow must have security-events: write to upload results. Without it, the analysis runs but the alerts never appear .
CodeQL is semantic, not a linter. It builds a database and traces data flow, which is why it catches bugs that pattern matching misses—and why it is slower .
The product split matters. Private repositories need GitHub Secret Protection for Secret Scanning and GitHub Code Security for CodeQL. Public repositories get basic versions for free .

Remember: Secret Scanning protects the keys. CodeQL protects the logic. Push Protection stops the leak before it happens. The two tools are complementary, but their scopes are separate: CodeQL no longer looks for secrets, and Secret Scanning does not analyze data flow. Use both, and configure the permissions and licenses they require.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!