What's changed: New GH-500 Chapter 5 (vulnerability context & prioritization = CVE/CWE/GHSA, repo advisories, rulesets enforcing severity/SLA, CVSS+EPSS+reachability+asset criticality, campaigns/bulk management, automated dismissal with documentation; customization & governance & shift-left = CodeQL query suites [default/security-extended/custom], roles/delegated exceptions/ownership, cross-suite ruleset enforcement, Push Protection/dependency scanning/pre-merge analysis)
5.2Customizing Detection, Governance, and Shifting Left
Understand customizing CodeQL query suites and language-specific analysis, tailoring to org risk profiles, security roles/delegated exceptions/alert ownership, cross-team collaboration, cross-suite rulesets/policies/enforcement, and strengthening prevention (shift left) via push protection, dependency scanning, and pre-merge analysis.
Risk differs by organization, so detection and operations are tailored to your org. GH-500 tests customizing CodeQL detection, governance of roles and exceptions, cross-suite rulesets and enforcement, and shifting left to move prevention earlier.
5.2.1Customizing CodeQL query suites
CodeQL uses query suites to decide "which rules run." The default is a lower-false-positive base set, security-extended detects more broadly (with more noise), and you can add org-specific custom queries/suites to catch your own vulnerable patterns. Considering language-specific analysis traits (e.g., compile requirements), balance detection breadth vs false positives to your risk profile.
5.2.2Roles, delegated exceptions, and cross-suite rulesets
Governance separates permissions by security role (admin, security manager, developer) and clarifies alert ownership. Exceptions are granted as delegated exceptions—approval-gated and temporary, controlling who may approve. Cross-suite rulesets/policies can require and enforce Code Security, Secret Protection, and Supply Chain together, keeping a consistent posture across teams. Collaboration (working on alerts/campaigns together) is also key to operations.
5.2.3Strengthening prevention via shift left
Shift left moves security earlier in development to prevent problems before they grow. Concretely: Push Protection stops secrets at the source, dependency scanning (Dependabot/Dependency Review) detects/blocks risky dependencies early, and pre-merge analysis (Code Scanning as a required check) prevents merging vulnerable code. Since fixing later costs more, "early prevention" improves overall efficiency and reduces risk.
Common: (1) CodeQL tunes detection via query suites (default / security-extended / custom queries)—balance detection vs false positives. (2) Governance = roles, alert ownership, delegated exceptions (approval-gated), and cross-suite rulesets enforcing Code/Secret/Supply Chain together. (3) Shift left = early prevention via Push Protection / dependency scanning / pre-merge analysis (later fixes cost more).
Watch out: (1) security-extended detects more but adds noise—choose by risk profile (broader isn’t always better). (2) Delegated exceptions are approval-gated temporary exceptions, not permanent waivers. (3) The point of cross-suite rulesets is enforcing multiple pillars together, not just one. (4) Shift left emphasizes prevention but doesn’t remove detection/remediation (later stages)—use layers.
5.2.4Section summary
- CodeQL balances detection vs false positives via query suites (default/security-extended/custom)
- Governance: roles, alert ownership, delegated exceptions (approval-gated), cross-suite rulesets enforced
- Shift left: early prevention via Push Protection / dependency scanning / pre-merge analysis (later fixes cost more)
- security-extended is broader but noisier; delegated exceptions are temporary; prevention doesn’t replace detection/remediation
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. In CodeQL, what decides "which rules run" and tunes the balance between detection breadth and false positives?
Q2. You want to require and enforce Code Security, Secret Protection, and Supply Chain together org-wide. What do you use?
Q3. Which combination concretely practices "shift left" in security operations?
Q4. You must allow an exception to a policy block. What is the correct governance handling?
Q5. Which correctly describes CodeQL’s security-extended query suite?
Q6. What is the correct response to "we shifted left thoroughly, so detection/remediation in later stages is unnecessary"?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.