For compiled languages, CodeQL performs extraction bymonitoring the normal build process.
This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.
This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.

You can find security alerts from Dependabot, Secret scanning, and Code scanning under your repository's Security tab. Security alerts for a repository are visible to people with write, maintain, or admin access to the repository and, when the repository is owned by an organization, organization owners.

Push protection is a secret scanning feature that is designed to prevent sensitive information, such as secrets or tokens, from being pushed to your repository in the first place. Unlike secret scanning, which detects secrets after they have been committed, push protection proactively scans your code for secrets during the push process and blocks the push if any are detected.
Push protection helps you avoid the risks associated with exposed secrets, like unauthorized access to resources or services. With this feature, developers get immediate feedback and can address potential issues before they become a security concern.

Repository administrators, organization owners, and users with write or maintain access can enable Dependabot alerts by enabling the dependency graph and Dependabot alerts in their repository's settings. Enabling Dependabot is an action that can be performed at the repository, organization, or enterprise level.
Repository Administrators: These users have access to repository settings, allowing them to enable or disable Dependabot alerts for that specific repository.

By default, when push protection is enabled for a repository, anyone with write access can still push a secret to the repository, provided that they specify a reason for bypassing push protection.