The security-extended query suite includes additional CodeQL queries that detect lower severity issues than those in the default security-and-quality suite.
About CodeQL query suites
With CodeQL code scanning, you can select a specific group of CodeQL queries, called a CodeQL query suite, to run against your code. The following built-in query suites are available through GitHub:
default query suite.
security-extended query suite. This suite is referred to as the "Extended" query suite on GitHub.
Currently, both the default query suite and the security-extended query suite are available for default setup for code scanning.

Using the Custom setting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.
This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.
Note: Configuring your watch settings for an individual repository
You can choose whether to watch or unwatch an individual repository. You can also choose to only be notified of certain event types such as issues, pull requests, releases, security alerts, or discussions (if enabled for the repository), or completely ignore an individual repository.
1.On GitHub, navigate to the main page of the repository.
2. In the upper-right corner, select the "Watch" drop-down menu, then click a watch option.
If you want to further customize notifications, click Custom, then select specific events that you want to be notified of, such as Issues or Pull Requests, in addition to participating and
@mentions.
For example, if you select "Issues", you will be notified about, and subscribed to, updates on every issue (including those that existed prior to you selecting this option) in the repository. If you're @mentioned in a pull request in this repository, you'll receive notifications for that too, and you'll be subscribed to updates on that specific pull request, in addition to being notified about issues.

Resolving alerts from secret scanning
After reviewing the details of a secret scanning alert, you should fix and then close the alert.
Fixing alerts
Once a secret has been committed to a repository, you should consider the secret compromised.
GitHub recommends the following actions for compromised secrets:
Verify that the secret committed to GitHub is valid.
Review and update any services that use the old token. For GitHub personal access tokens, delete the compromised token and create a new token.
Depending on the secret provider, check your security logs for any unauthorized activity.

[A, not B, D] Use the paths filter when you want to include file path patterns or when you want to both include and exclude file path patterns. Use the paths-ignore filter when you only want to exclude file path patterns. You cannot use both the paths and paths-ignore filters for the same event in a workflow.
[Not E] Pattern: docs/**/*.md
A file with a .md suffix anywhere in the docs directory.

REST API endpoints for code scanning
Use the REST API to retrieve and update code scanning alerts from a repository.
[D] Get a code scanning alert
Gets a single code scanning alert.
OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.
Fine-grained access tokens for "Get a code scanning alert"
This endpoint works with the following fine-grained token types:
GitHub App user access tokens
GitHub App installation access tokens
Fine-grained personal access tokens
[C] Update a code scanning alert
Updates the status of a single code scanning alert. OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.