Question

A security engineer is triaging the code scanning alert backlog for a critical payment service. Two open CodeQL alerts compete for immediate attention: Alert 1 is tagged with a security-severity score of 9.1 (Critical) but has a low occurrence count, while Alert 2 shows a code-scanning severity of 'error' but carries no security-severity metadata because it comes from a code-quality query. The team's remediation ruleset gates merges based on security-severity thresholds. Which alert should the engineer prioritize for remediation first, and why?

Accepted Answer

Alert 1, because its security-severity score of 9.1 reflects exploitable vulnerability risk that the ruleset uses to gate merges, making it the higher security priority.

Answer

Alert 2, because a code-scanning severity of 'error' always outranks any security-severity score when both are present.

Answer

Alert 2, because alerts without security-severity metadata are treated as the most dangerous and are auto-escalated by the ruleset.

Answer

Alert 1, but only after manually assigning it a code-scanning severity of 'error' since security-severity alone cannot be used for prioritization.