{"id":132654,"date":"2025-10-24T05:55:58","date_gmt":"2025-10-24T12:55:58","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/power-platform\/blog\/?p=132654"},"modified":"2025-10-24T05:56:01","modified_gmt":"2025-10-24T12:56:01","slug":"strengthen-your-power-pages-security-with-codeql-code-scan","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/power-platform\/blog\/power-pages\/strengthen-your-power-pages-security-with-codeql-code-scan\/","title":{"rendered":"Strengthen Your Power Pages Security with CodeQL code scan"},"content":{"rendered":"\n

As web applications have become central to business operations, securing every line of custom code is more critical than ever. With the introduction of CodeQL<\/a> <\/strong>scan in Power Pages toolset, we are empowering developers with static code analysis directly within their development workflow.<\/p>\n\n\n\n

Why CodeQL <\/h2>\n\n\n\n

Security vulnerabilities can hide in plain sight especially in custom HTML and JavaScript that power dynamic site experiences. Traditional testing and QA often detect issues too late in the development cycle. However, CodeQL<\/strong>, a semantic code analysis engine from GitHub, scans your site\u2019s codebase to identify vulnerabilities before they become security incidents. Whether it\u2019s cross-site scripting (XSS), injection attacks, or insecure DOM access, CodeQL helps uncover these risks early and automatically.<\/p>\n\n\n\n

When and Where CodeQL scan is Available<\/h2>\n\n\n\n

CodeQL scan is available in VS Code desktop for locally downloaded Power Pages sites<\/strong>. These are marked with the Current<\/strong> tag in your list of active sites. This means you must first download your site for local development using tools Visual Studio Code or Power Platform CLI.<\/p>\n\n\n\n

To use this feature, make sure the Power Platform Tools<\/strong> extension is installed in Visual Studio Code (VS Code) Desktop. If you haven\u2019t set up VS Code Desktop yet, see the Set up Visual Studio Code for Power Pages<\/a> documentation for guidance. Once downloaded, the Run CodeQL screening<\/strong> option becomes available in the VS Code desktop’s Power Pages Actions view<\/a>. <\/p>\n\n\n

\"Active<\/figure>\n\n\n\n

When selected, it:<\/p>\n\n\n\n