code-scanning

Find and fix your first CodeQL alert

Fork GitHub's code-scanning demo, enable CodeQL default setup with gh, list the reflected XSS alert, apply Copilot Autofix via API, and merge after review.