CodeQL is GitHub's expressive language and engine for code analysis, which allows you to explore source code to find bugs and security vulnerabilities. CodeQL is free for OSS, and comes bundled with hundreds of security and quality queries that you can use out-of-the-box to scan open source projects. In this workshop we'll start with explaining how to use the codeql tool, explain the basic structure of a CodeQL query, and then show how to use classes and predicates to improve query readability. After that, we'll focus on data flow analysis and taint tracking which we then use for writing a real world query. Starting with a CVE description and an advisory for [CVE-2022-41852] we'll incrementally develop a query for it and show how you can then use the multi repository variant analysis beta to find vulnerable projects across GitHub. Learning Goals Get to know the basic structure of a CodeQL query. Use the CodeQL libraries for Java. Learn to build and structure queries using classes and predicates. Use data flow analysis and taint tracking to find a real-world RCE vulnerability. Prerequisites No prior CodeQL knowledge required. Basic knowledge of the Java programming language. Please prepare a laptop using the following instructions (local or cloud-based setup): https://gh.io/nc-2023-setup