codeql

Code Scanning is enabled / CodeQL is configured

A GitHub Security Lab initiative, providing an in-repo learning experience, where learners secure intentionally vulnerable code.

Production-grade DevSecOps pipeline with SAST, SCA, secret detection and IaC scanning using CodeQL, Trivy and Gitleaks. Built on GitHub Actions with AWS deployment.

Intentionally Vulnerable Serverless Functions to understand the specifics of Serverless Security Vulnerabilities

Hands-on Git, GitHub, cybersecurity workflow, Python log analysis, testing, and CI learning project.

Satellite mission-tasking API wrapped in a full DevSecOps pipeline - SAST, secret scanning, SBOM + Sigstore signing, Trivy, CodeQL, simulated K8s deploy

Enterprise-grade autonomous AI document processing pipeline with asynchronous task queues, multimodal LLM extraction, Pydantic v2 validation contracts, and zero-trust CodeQL hardening.

Hands-on demo showing how GitHub Advanced Security (CodeQL, secret scanning, Dependabot) catches vulnerabilities in AI-generated code.

Agentic fuzzing framework and Claude Code plugin for local security testing with MCP tools, fuzzers, symbolic execution, SARIF, and patch validation.

GitHub Skills: Introduction to CodeQL

Evidence-driven Java security review workbench

Local triage for CodeQL alerts: reproduce in minutes, bisect the taint source with controlled variants, and verify the fix before pushing.

Turns SAST output (SARIF from CodeQL/Semgrep) into normalized AppSec metrics — by severity, rule, file, and tool. Hexagonal architecture, AWS Lambda + S3.

Python MCP bridge to the CodeQL language server for completions, diagnostics, navigation, and formatting

CodeQL course work — query writing and static analysis for security

Detects when a commit changes which authorization checkpoints protect an operation. Asks whether a security boundary moved, not whether code is vulnerable.

Scanner finding triage and pull-request security review for C#/.NET, backed by Roslyn semantic analysis. Early development.

GitHub Skills: Enable code scanning and secure your code with CodeQL.

CodeQL language support for Zed with Tree-sitter syntax highlighting and the CodeQL CLI language server.

Playing with FastAPI by creating an investment projections service (using Nutmeg's calculator to actually calculate the projections)