Question

Your security team has enabled push protection and pre-merge CodeQL analysis on a critical microservice repository. A developer opens a pull request from a feature branch, and CodeQL flags a new SQL injection alert in the PR check. The developer argues the alert should not block the merge because 'the code isn't on the default branch yet, so it's not a real exposure.' As the security lead defining the org's shift-left enforcement strategy, which response best reflects correct preventive security practice?

Accepted Answer

The pre-merge PR analysis is intentionally designed to catch vulnerabilities before they reach the default branch; the alert should be remediated on the feature branch before merge to prevent the flaw from ever entering protected code.

Answer

Since the code is not yet on the default branch, the alert can be safely dismissed as 'won't fix' and revisited only if it later appears in a default-branch scan.

Answer

Push protection already inspects source code for injection patterns, so the CodeQL PR alert is redundant and can be ignored.

Answer

PR-based CodeQL alerts are informational only and cannot be configured to block a merge, so remediation must wait until after the merge completes.