CodeQL
GitHub's semantic code analysis engine that finds vulnerabilities by querying code.
- Verified facts
- 5 of 5
- Alternatives ranked
- 3
- Approved reviews
- 0
- Visits sent from here
- 0
About CodeQL
CodeQL is the analysis engine behind GitHub code scanning. It turns a codebase into a database you can query, then runs queries written in its own QL language to find security bugs such as injection flaws and unsafe deserialization, along with their variants across the whole project. GitHub ships a large set of standard queries, and security researchers write their own to hunt for a pattern once it's found. You can run it through GitHub code scanning on pull requests, from the CodeQL CLI, or interactively with the VS Code extension. It covers languages including C and C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust and Swift. The query libraries are MIT-licensed, but the engine itself is not open source: it's free for public repositories and research, while scanning private code at a company requires GitHub Code Security. That tie to GitHub is the main reason teams compare it with Semgrep, SonarQube or Snyk.
Best for: Teams on GitHub and security researchers who want deep, query-based vulnerability hunting.
Pros and cons
What works
- Deep data-flow and taint analysis across a whole codebase
- Custom queries let you find every variant of a known bug
- Built into GitHub code scanning with alerts on pull requests
- Free for public repositories and research
Why people leave
- Private, commercial use requires a paid GitHub Code Security licence
- QL query language takes real effort to learn
- Compiled languages need a working build to create the database
Top CodeQL alternatives
See all 3
Why people left CodeQL
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from CodeQL, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of CodeQL
CodeQL: common questions
Is CodeQL free?
CodeQL has a free plan and paid plans.
Is CodeQL open source?
No, CodeQL is not open source. Open-source alternatives include Semgrep and SonarQube.
What platforms does CodeQL run on?
CodeQL is available for Windows, macOS and Linux.
What are the best alternatives to CodeQL?
The highest-ranked CodeQL alternatives right now are Semgrep, SonarQube and Snyk. See the full ranked list for pricing, platforms and verified facts.