Question

A security engineer fixed a CodeQL SQL-injection alert three months ago; the alert moved to 'Fixed' after the default branch was rescanned. This week a developer reverted part of that refactor in a new commit, reintroducing the vulnerable data-flow pattern on the default branch. Assuming CodeQL analysis runs on pushes to the default branch, what happens to the alert tracking, and what is the recommended remediation practice?

Accepted Answer

CodeQL reopens the original alert (returning it to 'Open') when the vulnerable pattern reappears on the analyzed branch, so the team should treat the reopened alert as active work rather than filing a brand-new issue.

Answer

The alert stays permanently 'Fixed' once resolved; CodeQL only creates a separate new alert with no link to the prior one, so the engineer must manually cross-reference the history.

Answer

The alert can only be reopened manually by a security manager, because CodeQL never automatically transitions an alert out of the 'Fixed' state.

Answer

Because the code was previously fixed, CodeQL suppresses detection of the reintroduced pattern for 90 days and will not alert until the suppression window expires.