GitHub for all users of the service , which was previously offered only to participants of a limited program for testing new experimental features. The service scans each 'git push' operation for potential vulnerabilities. The result is attached directly to the pull request. The checks use an engine , analyzing patterns with typical examples of vulnerable code (CodeQL allows creating a template of vulnerable code to identify similar vulnerabilities in the code of other projects).
During the beta testing of the service, scanning approximately 12,000 repositories revealed over 20,000 security issues, including serious problems leading to remote code execution and SQL injection. 72% of the identified issues were found during the pull request review stage, before acceptance, and fixed in less than 30 days (for comparison, general industry statistics show that only 30% of vulnerabilities are resolved in less than a month after detection).
Source: opennet.ru
