Problem
Checkmarx scans source as it sits in the repository. CodeQL has to observe a build. That single difference made Finastra’s migration a program rather than a tool swap: rolling CodeQL out across 80+ products meant getting large, long-lived codebases building reliably in CI, through long iteration with GitHub’s CodeQL and support teams.
Getting scans running was only half the problem. Two gaps made the results hard to operate. CodeQL has no equivalent of the detailed report Checkmarx produced for stakeholders, and GitHub’s vulnerability view has no native filter for findings a product team has requested to dismiss — so the review queue that mattered most was invisible. Then came volume: far more findings than teams had seen before, most of them false positives. Product teams pushed back, and the migration’s credibility was on the line.
Architecture decision
CodeQL Reporting is a Go backend with a React frontend, built around the two workflow gaps rather than around the scanner. It generates the detailed, shareable reports CodeQL lacks, and it turns dismissal requests into a first-class review queue — the state GitHub’s own view cannot show.
The second layer addresses volume. For every repository, the platform downloads the CodeQL SARIF, reconstructs the actual source code along each finding’s source-to-sink path, and sends that evidence — not just the alert metadata — to an LLM for triage. The model’s verdict is grounded in the same data flow a human reviewer would trace, which is what makes the triage defensible rather than a black-box score.
Outcome
The platform became the operating surface for the migration: reporting stakeholders could consume, a dismissal queue reviewers could actually work, and a triage layer that cut false-positive volume substantially. Specific reduction and adoption figures are pending approval for public use; this page will carry them once they are cleared.
← All projects