GitHub CodeQL vs GitHub Secret Scanning

GitHub CodeQL has no write-up on Specifiction yet; its figures are above.

GitHub Secret Scanning detects exposed credentials so they can be secured before exploitation. It scans every branch in Git history, plus issue and pull request content, discussions, wikis, and secret gists. Detected leaks produce repository alerts with details about the credential, while push protection can block secrets before they enter code. Organizations can define regular expressions for their own secret formats. Generic patterns cover items such as private keys, connection strings, and API keys, and AI detection can identify unstructured secrets such as passwords. Validity checks may contact issuing services to see whether credentials remain active. GitHub can work with providers to validate findings and notify them for actions such as revocation. Scanning is automatic and free for public repositories. Private and internal organization repositories require Secret Protection on GitHub Team or Enterprise Cloud; Enterprise Server supports user-owned repositories with that protection. It is available through API, web, and self-hosted deployment, with hybrid deployment.