Implement static analysis security testing (SAST)
Implementation Effort: Medium – Enabling CodeQL code scanning across repositories and wiring it into pull request and CI workflows takes setup and tuning across engineering teams. User Impact: Low – Code scanning runs in the pipeline and surfaces alerts to maintainers; end users are not affected. Lifecycle Stage: Code
Overview
Implement static application security testing in your pull request and CI workflows so vulnerabilities are identified and addressed before code merges. CodeQL is the static analysis engine that powers code scanning in both GitHub Code Security and GitHub Advanced Security for Azure DevOps. It treats code as data, building a queryable database of the entire codebase and running semantic queries that trace data flows from untrusted inputs to security-sensitive operations.
On GitHub, CodeQL supports C, C++, C#, Go, Java, Kotlin, JavaScript/TypeScript, Python, Ruby, Swift, and Rust. GitHub Advanced Security for Azure DevOps provides comparable language coverage including Rust. Verify the latest supported languages for your platform version as coverage continues to expand.
When integrated into CI pipelines, code scanning runs automatically on every pull request and produces alerts inline in the review interface. Organizations can extend coverage with custom CodeQL query packs tailored to their frameworks and security requirements.
On GitHub, you can upload SARIF results from other scanners so findings appear alongside CodeQL alerts in code scanning. SARIF (Static Analysis Results Interchange Format) is an OASIS standard that provides a vendor-neutral schema for security tool output — because CodeQL, Microsoft Defender for Cloud, and third-party scanners all produce SARIF, organizations can aggregate findings from multiple tools into a single code scanning dashboard without vendor lock-in. In Azure DevOps, GitHub Advanced Security for Azure DevOps surfaces CodeQL results in the Advanced Security experience; for other SAST tools, publish results as pipeline artifacts and/or integrate with your defect tracking and security monitoring (for example, Work Items and/or Defender for Cloud) rather than assuming native SARIF ingestion parity.
Static application security testing analyzes source code to identify vulnerabilities such as SQL injection, cross-site scripting, authentication bypasses, and insecure deserialization before code is compiled, packaged, or deployed. This task aligns most directly to NIST SSDF PW.7.1, which calls for determining which code review and code analysis tools should be used and how the information from them should be incorporated.
Executable-code testing requirements should be addressed by dynamic application security testing and other runtime testing tasks, not by SAST alone. Without SAST in the development workflow, these flaws can pass through code review and into production, where remediation is more expensive and operationally disruptive.
Organizations that do not implement SAST are relying entirely on manual code review to catch security defects — a process that research consistently shows misses the majority of exploitable vulnerabilities. By identifying code-level vulnerabilities early, SAST helps mitigate the supply chain exploitation vectors described in the OWASP CI/CD Security Top 10. By catching vulnerabilities before code is merged, SAST operationalizes Assume breach — treating every change as potentially flawed until analyzed — and supports Verify explicitly by making security analysis a required, evidence-based gate rather than an assumption of trust.
Emerging capability (preview): Microsoft is extending code analysis with agentic, multi-model vulnerability discovery — the Microsoft Security multi-model agentic scanning harness (codename MDASH), announced at Build 2026 and available in an expanded preview with Microsoft Defender integration. It is designed to complement — not replace — deterministic SAST engines such as CodeQL. Evaluating and piloting this capability is covered as a dedicated task; keep CodeQL code scanning as your baseline control.