When you write a CodeQL security query you specify where tainted input enters a system and the sinks where the tainted input can do damage. But taint specifications are often incomplete, which means even the best queries miss vulnerabilities.
Adaptive threat modeling (ATM) for CodeQL addresses this problem by semi-automatically boosting taint specifications using machine learning. The boosted query produces a ranked list of additional results for your inspection.
ATM is free for security research on open-source codebases.
Interested? Please sign up for our private beta. We’d love to get your feedback!
By joining this private beta program you accept the GitHub pre-release program terms and conditions.