All issues

Swift extractor internal error: assertion 'found != SwiftMangler::preloadedExtensionOrFilePrivateValueIndexes.end()' failed (declaration not found within parent)

#22224

· inequitas opened

on Jul 22, 2026

Consider testing CodeQL also against Kotlin EA versions

#22219

· scordio opened

on Jul 21, 2026

[java-kotlin] Autobuild sets unnecessary `maven.test.skip.exec` parameter

#22218

· scordio opened

on Jul 21, 2026

False positive: "Missing cross-site request forgery token validation" should not apply to Web API Controller Actions sharing a project with Browser-based actions

#22215

· daiplusplus opened

on Jul 21, 2026

Go: Why is DotDotCheck modeled as a complete path-injection barrier?

#22214

· wildoranges opened

on Jul 20, 2026

[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

#22213

· 1sgtpepper opened

on Jul 19, 2026

False positive Java. SpringBoot CSRF

#22199

· rcollette opened

on Jul 15, 2026

[C#] False positive in cs/simplifiable-boolean-expression for operator != implementation

#22190

· christiannagel opened

on Jul 14, 2026

Go: filepath.Clean with a prepended path separator is modeled as a path-injection sanitizer and causes false negatives

#22185

· wildoranges opened

on Jul 14, 2026

Go: DotDotReplaceAll ignores the replacement value and causes false-negative path-injection alerts

#22184

· wildoranges opened

on Jul 14, 2026

[C#] Improve "isExponentialRegex" detection logic in ReDoSQuery.qll to prevent false negatives

#22183

· gravitydeepimpact7463 opened

on Jul 13, 2026

java.io.File.getName() (Java) modeled as path-injection barrier causes false-negative path-traversal alerts

#22144

· wildoranges opened

on Jul 9, 2026