Query your codebase like a database to find vulnerability patterns across the whole repo.
CodeQL compiles source into a relational database and lets you write queries over it, which finds whole-program dataflow issues that pattern matchers miss. GitHub ships it as the engine behind code scanning, free for public repositories and licensed as part of GitHub Advanced Security for private ones.
Best for
From $30 per committer/month (GitHub Advanced Security, indicative)
Free tierFree tier: Free for public repositories on GitHub.
What drives the bill: Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.
Check current pricing on GitHub (Microsoft)’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
No reviews of CodeQL yet. If you have used it in anger, yours would be the first.
If CodeQL is not the right fit, these solve the same problem differently.
Security Testing
Pattern-based static analysis where rules look like the code they match.
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
Code Quality
The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.