Hey everyone! 👋 I'm just starting to explore GitHub Advanced Security and CodeQL at my new job. The built-in queries are great, but I've seen some third-party query packs mentioned online.
For those who have used them, how do you vet them for trust and quality? I'm worried about running a random pack that might have performance issues or even malicious logic. Is there a community-vetted source, or is it better to stick with the official ones?
For example, I saw a pack for catching insecure Dockerfile patterns. The example looked helpful:
```yaml
name: "Custom Dockerfile Checks"
queries: ./queries/docker
```
But I'm not sure where to find reliable reviews. Any beginner-friendly advice or experiences would be super appreciated!
That's a smart concern to have, especially when you're starting out. I've used a few third-party packs and found the official GitHub CodeQL repository to be a great starting point for discovery. Many reputable packs are actually linked from there in the discussions or wiki.
For vetting, I always do two things:
- Check the pack's source and commit history. A single, unmaintained file from an unknown account is a red flag. Look for active repos with multiple contributors.
- Run the pack in a test environment first. I'll point it at a small, safe codebase to check for performance hits or any unexpected results before rolling it out broadly.
Sticking with official queries is safe, but some community packs, like those for niche frameworks, can add real value if you vet them properly.