Skip to main content
Checks that code scanning alerts are identified and resolved.

​
About

When you connect GitHub to DSALTA, the platform retrieves the current security findings using read-only API access. DSALTA tracks their status and activates this check when action is required.

​
Why This Matters

Known vulnerabilities in your code and dependencies are publicly catalogued and actively exploited, often within hours of disclosure. Detecting and remediating them within a defined SLA is required by SOC 2 and ISO 27001.

​
How to Fix

Before you begin
  • Ensure you have admin access to the GitHub repository.
Enable and resolve code scanning alerts
  1. In GitHub, open Settings → Code security and analysis and enable Code scanning (CodeQL).
  2. Open the Security → Code scanning tab and review findings by severity.
  3. Fix the underlying code issue and merge. Re-run the analysis to confirm the alert clears.
Once the alerts are resolved, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the GitHub integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in GitHub.