Issues · github/codeql · GitHub

Labels Milestones New issue

False positive: "Missing cross-site request forgery token validation" in C# API for endpoint with no cookie/session tokens

#21665

· joepvtl opened

on Apr 8, 2026

Should `java/trust-boundary-violation` recognize regex validation guards?

#21655

· MarkLee131 opened

on Apr 4, 2026

`java/sensitive-log`: missing sanitizer for hashed/encrypted data

#21653

· MarkLee131 opened

on Apr 4, 2026

False positive: `java/zipslip` flags archive entry names used for class loading, not file extraction

#21606

· MarkLee131 opened

on Mar 28, 2026

False Positive: AndroidInsecureLocalAuthentication.ql

#21527

· Carlson-JLQ opened

on Mar 21, 2026

False Positive: DoNotCallFinalize.ql cannot detect 'finalize()' in the function call chain.

#21394

· Carlson-JLQ opened

on Mar 1, 2026

False Positive: cpp/use-after-free on chained assignment after delete

#21187

· cpriyakant opened

on Jan 19, 2026

False positive - C# IEquatable: Equals(object) not implemented alert when Equals(object?) is implemented

#21128

· Thomasedv opened

on Jan 8, 2026

False positive — CodeQL failing due to lack of Python files when they only exist on the `main` branch

#21106

· andrzej-pomirski-yohana opened

on Jan 6, 2026

Organization owned immutable actions raise warning about unpinned 3rd party actions tag

#21076

· StephenHodgson opened

on Dec 21, 2025

False positive: "Missing function level access control" where public endpoint name contains "Edit"

#21042

· joepvtl opened

on Dec 16, 2025

False positive: Dereferenced variable may be null ignore NRT attributes

#20828

· Euan-McVie opened

on Nov 12, 2025