Hey everyone, I've been running GitHub Advanced Security (GHAS) with CodeQL for a few months now on our main codebase. It's been really insightful for catching some classic web vulnerabilities, but I'm starting to wonder if the default setup is a bit one-size-fits-all.
Our stack is a mix of Go microservices and some Python data processing tools. We're not a traditional web app shop; a lot of our risk is in internal API logic, data validation, and dependency management. I feel like the default query suite (security-and-quality) is heavily weighted towards the OWASP Top 10, which is great, but maybe not the *most* relevant for our entire codebase.
For example, we're getting tons of alerts for potential SQLi in contexts that are actually internal, non-user-facing APIs. Meanwhile, I'm more concerned about issues in our service-to-service auth or how we're handling specific data serialization. It feels like we're tuning out a lot of "noise" (for us) and might be missing other signals.
Has anyone else felt this way? Did you create a custom query pack or significantly tweak the default suite? I'm curious about:
- How you identified the query categories that were most relevant to your actual architecture.
- Whether you found good community query packs for backend/service-oriented code.
- If trimming down the default suite improved your team's engagement with the alerts.
I don't want to throw the baby out with the bathwater—the OWASP stuff is important—but I'm worried we're not getting the full value for our specific context. Any experiences or config snippets you can share would be awesome