Issues · github/codeql · GitHub

Labels Milestones New issue

[question?] counterintuitive class method behaviour

#21670

· k4lizen opened

on Apr 8, 2026

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

#21669

· tacu22 opened

on Apr 8, 2026

py/insecure-protocol missing urllib3 ssl_version tracking & false positive on secure defaults

#21666

· 9iang22 opened

on Apr 8, 2026

False positive: "Missing cross-site request forgery token validation" in C# API for endpoint with no cookie/session tokens

#21665

· joepvtl opened

on Apr 8, 2026

Can the location of the disk cache be customised, and does CodeQL gracefully handle missing cache?

#21663

· gsutherland-trailofbits opened

on Apr 7, 2026

actions/unpinned-tag does not flag unpinned reusable workflow calls (job-level uses:)

#21659

· PhilipAtCisco opened

on Apr 6, 2026

Should `java/trust-boundary-violation` recognize regex validation guards?

#21655

· MarkLee131 opened

on Apr 4, 2026

`java/sensitive-log`: missing sanitizer for hashed/encrypted data

#21653

· MarkLee131 opened

on Apr 4, 2026

False positive: in`java/path-injection`,`Path.toRealPath()` not recognized as sanitizer

#21651

· MarkLee131 opened

on Apr 4, 2026

False positive: `java/sensitive-log` overly broad variable name regex causes widespread false positives

#21649

· MarkLee131 opened

on Apr 4, 2026

Incomplete naming schema and API usage patterns in py/insecure-cookie

#21647

· tacu22 opened

on Apr 3, 2026

Support for `.razor` files is unclear

#21645

· Frulfump opened

on Apr 3, 2026