Starting May 30, 2025, CodeQL no longer generates code scanning alerts for hardcoded secrets. If you want to detect hardcoded secrets in your repositories, we recommend using secret scanning, which offers better precision and recall than CodeQL. Secret scanning is a feature of GitHub Secret Protection.

With secret scanning, you can:

  • Detect over 300 types of hardcoded secrets in your repositories.
  • Use GitHub Copilot to find generic passwords.
  • Manage all your hardcoded secret alerts in one place.

Read our secret scanning documentation to learn how it works.

What changed?

With the release of CodeQL 2.21.1 on May 30, 2025, we disabled CodeQL queries that detect hardcoded secrets. The next time CodeQL analyzes your repository, any open code scanning alerts related to hardcoded secrets will be closed. These alerts will remain in your historical security alert backlog.

These changes will also be included in GitHub Enterprise Server (GHES) 3.18.

The following CodeQL queries are now disabled:

  • cs/hardcoded-connection-string-credentials
  • cs/hardcoded-credentials
  • cs/password-in-configuration
  • go/hardcoded-credentials
  • java/hardcoded-credential-api-call
  • java/password-in-configuration
  • js/hardcoded-credentials
  • js/password-in-configuration-file
  • py/hardcoded-credentials
  • rb/hardcoded-credentials
  • swift/constant-password
  • swift/hardcoded-key

Why this change?

Previously, both CodeQL and secret scanning could detect hardcoded secrets, but this often resulted in duplicate alerts for the same secret. This led to extra manual work to deduplicate alerts between code scanning and secret scanning. Secret scanning provides higher accuracy and recall for hardcoded secrets. It also gives you more metadata to help with remediation.

How do I get started with GitHub Secret Protection?

Check out this video to learn more about getting started with GitHub Secret Protection:

Watch this video to learn more about deploying and managing Secret Protection at scale: