CodeQL
Query your codebase like a database to find vulnerability patterns across the whole repo.
What it is
CodeQL compiles source into a relational database and lets you write queries over it, which finds whole-program dataflow issues that pattern matchers miss. GitHub ships it as the engine behind code scanning, free for public repositories and licensed as part of GitHub Advanced Security for private ones.
Best for
Where it is strong
- Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
- Free on public repositories, with results in the GitHub security tab.
- Custom queries let you encode organisation-specific security rules.
Where it falls short
- Writing custom CodeQL queries is a specialist skill with a steep learning curve.
- Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
- Private-repo licensing through Advanced Security is expensive at scale.
Pricing
From $30 per active committer/month (GitHub Code Security)
Free tierFree tier: Free for public repositories on GitHub.
What drives the bill: Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.
Check current pricing on GitHub (Microsoft)’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use CodeQL say
No reviews of CodeQL yet. If you have used it in anger, yours would be the first.
Alternatives to CodeQL
If CodeQL is not the right fit, these solve the same problem differently.
Semgrep
Security Testing
Pattern-based static analysis where rules look like the code they match.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
SonarQube
Code Quality
The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.