Supported secrets
This table lists the secrets supported by secret scanning. You can see the types of alert that get generated for each token, as well as whether a validity check is performed on the token.
Provider: Name of the token provider.
Partner: Token for which leaks are reported to the relevant token partner. Applies to public repositories only.
*-> User: Token for which leaks are reported to users on GitHub.
Applies to public repositories, and to private repositories where GitHub Secret Protection and secret scanning are enabled.
-> Includes default tokens, which relate to supported patterns and specified *custom patterns*, as well as non-provider tokens such as private keys, which usually have a higher ratio of false positives.
For secret scanning to scan for non-provider patterns, the detection of non-provider patterns must be enabled for the repository or the organization.

Common Weakness Enumeration (CWE) is used by CodeQL to describe the vulnerabilities it detects in code scanning alerts. CodeQL's queries are designed to identify a wide range of weaknesses, and each security query is associated with one or more specific CWEs, providing developers with standardized identifiers for the types of vulnerabilities found.
By associating alerts with CWEs, CodeQL provides a structured and informative approach to vulnerability management, making it easier for development teams to understand, address, and prevent security issues.
Note: The Common Weakness Enumeration (CWE) system is an industry-standard way of cataloging insecure software development patterns. CodeQL runs hundreds of queries out of the box that are able to detect an even greater number of CWEs. We went back through our existing queries, and aligned dozens of them with updated CWE IDs to give users better insight into the potential impact of a security issue when an alert is flagged up by code scanning.
Incorrect:
[Not B]
Vulnerability Exploitability eXchange (VEX) is not used by CodeQL; rather, CodeQL and VEX are complementary tools in software security: CodeQL identifies code vulnerabilities, while VEX communicates the exploitability of a vulnerability within a specific product context, helping users focus on relevant threats.
[Not C]
GitHub Advisories (GHSA) is a database of CVEs and GitHub-originated security advisories affecting the open source world. Advisories may or may not be documented in the National Vulnerability Database. Dependency-Track integrates with GHSA by mirroring advisories via GitHub's public GraphQL API.
[Not D]
CodeQL finds the vulnerability, and CVE provides the universally recognized identifier and description for that specific vulnerability, allowing for better communication and faster response within the cybersecurity community.
Common Vulnerabilities and Exposures (CVE) is a standardized dictionary that provides unique identifiers for publicly known cybersecurity weaknesses in software and hardware. Maintained by the MITRE Corporation and funded by the U.S. Department of Homeland Security, CVE ensures a common language for cybersecurity professionals to track, discuss, and address vulnerabilities effectively across the industry. Each CVE entry includes an identifier, a description, and references to publicly available information about the vulnerability.

Secret scanning push protection is a security feature that prevents sensitive information like API keys or tokens from being pushed to a repository in the first place. It works by proactively scanning code during the push process and blocking any attempts to commit secrets. This differs from regular secret scanning, which only detects secrets after they have been committed.

[B] Build Modes
The CodeQL Action supports different build modes for analyzing the source code. The available build modes are:
none: The database will be created without building the source code. Available for all interpreted languages and some compiled languages.
*-> autobuild: The database will be created by attempting to automatically build the source code.
Available for all compiled languages.
manual: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between the init and analyze steps. Available for all compiled languages.
[D] Actions
This repository contains several actions that enable you to analyze code in your repository using CodeQL and upload the analysis to GitHub Code Scanning. Actions in this repository also allow you to upload to GitHub analyses generated by any SARIF-producing SAST tool.
Actions for CodeQL analyses:
*-> init: Sets up CodeQL for analysis.
analyze: Finalizes the CodeQL database, runs the analysis, and uploads the results to Code Scanning.