GitHub · GH-500
Triage, autofix, and tuning
GH-500 · Lesson 11 of 16 · 1:22:10
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: reading code scanning results and data flow paths, the alert lifecycle with Copilot Autofix and agentic autofix, severity, security severity, category labels, and dismissals, advanced CodeQL configuration with query suites, packs, paths, build modes, model packs, and threat models, and troubleshooting failed or slow scans. Includes three original practice questions.
Preview the topics
- A developer merged a fix for a SQL injection alert on payments-core, and wants to know how the alert gets closed. What happens?
- Half of Contoso’s alerts come from a generated client folder that developers never edit. What is the cleanest way to stop analyzing it?
- The nightly CodeQL scan of Contoso’s mobile app fails with no source code was seen during the build. What should the team try first?