What's changed: New GH-500 Chapter 5 (vulnerability context & prioritization = CVE/CWE/GHSA, repo advisories, rulesets enforcing severity/SLA, CVSS+EPSS+reachability+asset criticality, campaigns/bulk management, automated dismissal with documentation; customization & governance & shift-left = CodeQL query suites [default/security-extended/custom], roles/delegated exceptions/ownership, cross-suite ruleset enforcement, Push Protection/dependency scanning/pre-merge analysis)
5.2Customizing Detection, Governance, and Shifting Left
Understand customizing CodeQL query suites and language-specific analysis, tailoring to org risk profiles, security roles/delegated exceptions/alert ownership, cross-team collaboration, cross-suite rulesets/policies/enforcement, and strengthening prevention (shift left) via push protection, dependency scanning, and pre-merge analysis.
Risk differs by organization, so detection and operations are tailored to your org. GH-500 tests customizing CodeQL detection, governance of roles and exceptions, cross-suite rulesets and enforcement, and shifting left to move prevention earlier.
5.2.1Customizing CodeQL query suites
CodeQL uses query suites to decide "which rules run." The default is a lower-false-positive base set, security-extended detects more broadly (with more noise), and you can add org-specific custom queries/suites to catch your own vulnerable patterns. Considering language-specific analysis traits (e.g., compile requirements), balance detection breadth vs false positives to your risk profile.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.