Question

A developer opens a pull request that introduces a SQL injection vulnerability. CodeQL code scanning flags the alert on the PR and displays a suggested code change generated by CodeQL autofix. The developer wants to apply the fix as efficiently and safely as possible. What is the recommended way to handle the autofix suggestion?

Accepted Answer

Review the suggested fix for correctness, commit it to the PR branch (editing if needed), and let code scanning re-run to confirm the alert is resolved

Answer

Dismiss the alert as 'Used in tests' since autofix suggestions are automatically validated by CodeQL before being shown

Answer

Merge the PR immediately because the presence of an autofix suggestion means the vulnerability is already remediated in the analyzed code

Answer

Disable CodeQL autofix at the repository level, then manually rewrite the query so the alert no longer triggers