CodeQL vs Semgrep
Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.
Entry price
From $30 per active committer/month (GitHub Code Security)
Free tierFrom $30 per contributor/month (Teams, per product)
Free tierWhat drives the bill
The metric that actually scales your invoice.
Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.
The CLI plus community rules costs nothing and covers a lot. Teams is priced per product per contributor — Code $30, Supply Chain $30, Secrets $15 — so scanning for all three multiplies the per-contributor figure.
Free tier
Free for public repositories on GitHub.
Open-source CLI is free and complete; hosted platform free for up to 10 contributors.
Open source
MIT (queries)
LGPL-2.1 (CLI)
Self-hostable
No-code authoring
Languages
Platforms
Fits teams
Adoption
Widely used
GitHub (Microsoft) · since 2019
Widely used
Semgrep · since 2020
Strengths
- Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
- Free on public repositories, with results in the GitHub security tab.
- Custom queries let you encode organisation-specific security rules.
- Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
- Free CLI with a large community rule registry is immediately useful.
- Fast enough to run on every pull request without complaint.
Limitations
- Writing custom CodeQL queries is a specialist skill with a steep learning curve.
- Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
- Private-repo licensing through Advanced Security is expensive at scale.
- Pattern matching without full dataflow misses some vulnerability classes.
- Community rule quality is uneven; expect to curate.
- Advanced dataflow and supply-chain features are paid only.
Best for
GitHub-hosted projects wanting deep static security analysis, free if the repo is public.
Teams that want customisable static analysis and can start entirely for free.
All of these integrate with: VS Code, Jenkins.
Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.