CodeQL
CodeQL is a semantic code analysis engine that allows users to query code as if it were data.
Our verdict
Who it's for
Discover vulnerabilities across a codebase with industry-leading semantic code analysis.
Who should look elsewhere
Learning curve
Pros
- +Powerful code analysis
- +Security focus
- +GitHub integration
- +Custom queries
- +Free for public repos
Cons
- −Learning curve
- −Query writing complex
- −Slow scans
- −Resource intensive
- −False positives
Key features
- ✓Semantic code analysis
- ✓Security queries
- ✓Custom queries
- ✓Vulnerability detection
- ✓GitHub integration
- ✓Multi-language
Pricing
| Plan | Price | Billing | Notes |
|---|---|---|---|
| Free (Public repos) | $0 | month | Full CodeQL scanning; Public repositories; Community support |
| Code Security | $30 | month | CodeQL scanning; Secret scanning; Dependency review |
| Secret Protection | $19 | month | Push protection; Custom patterns; Alert notifications |