CodeQL
CodeQL is a freemium static analysis engine used to query source code as a database for security bugs for developers and application security teams.
0 upvotes · 0 downvotes
No ratings yet
- Category
- Application Security
- Pricing
- Freemium
- Platforms
- LinuxWindowsmacOS
- Reviewed
- Last reviewed 25 October 2026
- Links
- GitHub
What it is
A semantic code analysis system from GitHub that builds a relational database of a codebase and runs QL queries against it. Query packs cover many languages and can find injection, path traversal, and other common flaws.
What it helps with
- Finding security bugs with deep data-flow analysis
- Running the same checks in CI on every pull request
- Writing custom QL queries for your own bug patterns
- Reviewing open source projects with public query packs
Who it's for
Application security engineers, developers, and researchers who analyze source code.
Worth knowing
The CodeQL CLI is proprietary under GitHub's CodeQL Terms. It is free for open source research and academic use, and GitHub Advanced Security covers private repositories. The public query packs are MIT.
Is CodeQL open source?
No, the CLI is proprietary; only the query packs are MIT, so this listing does not tick open source.
How is it different from Semgrep?
In our view CodeQL goes deeper on data-flow for fewer languages, while Semgrep is lighter and easier for custom rules across many languages.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.