CodeQL vs Mend.io

From $30 per active committer/month (GitHub Code Security)

Quote on request

Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.

Quote-based enterprise pricing, typically per developer or per application.

Free for public repositories on GitHub.

Free tier for small teams on Mend's developer products.

Widely used

GitHub (Microsoft) · since 2019

Widely used

Mend.io · since 2011

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Licence compliance reporting is the strongest in the category and often the reason legal approves a release.
• Reachability analysis reduces the transitive-dependency alert flood.
• Automated remediation pull requests.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• SAST is weaker than dedicated code-analysis vendors.
• Enterprise pricing and sales process.
• Interface is dated in places.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Enterprises where open-source licence compliance is as important as vulnerability management.