CodeQL (GitHub)
Semantic code analysis engine used for code scanning queries and security research free for public repos and part of GitHub Advanced Security for private code.
Overview
CodeQL lets you write queries that traverse code as data so you can detect whole vulnerability classes across large repositories. GitHub uses CodeQL to power code scanning on pull requests which helps teams catch issues before merge. Public repositories get scanning at no cost while private repositories access deeper controls as part of GitHub Advanced Security.
Companies adopt CodeQL to hunt variant bugs enforce secure patterns and build internal rulepacks that codify past incidents. The query language composes well so security engineers can share libraries and keep findings precise and explainable. With CI integrations SARIF outputs and auto triage features CodeQL fits modern pipelines and makes results easy to route to owners for fixes.
Key features
- Free code scanning for public repositories on GitHub dot com
- Advanced Security brings enterprise features for private repos
- Declarative query language to model flows and data dependencies
- Extensive query packs and libraries maintained by community
- CI integrations with SARIF outputs for routing and dashboards
- Variant analysis to find bug families across services
- Autofix suggestions and code review checks on pull requests
- Documentation and workshops for security engineering teams
Best for
- Gate pull requests with code scanning before merge
- Build organization rulepacks based on past incidents
- Run variant analysis to remove whole bug classes at once
- Export SARIF to SIEM and dashboards for leadership views
- Educate developers with precise fix examples in checks
- Schedule repo wide scans to catch drift and regressions
- Track time to remediation for compliance reporting
- Share portable queries across languages and repos
Capabilities
Pull Request Checks
Add scanning to CI so risky flows fail early with precise messages that teach secure alternatives.
Reusable Libraries
Compose queries and packs that your org can reuse to enforce standards across languages.
Variant Analysis
Generalize a bug into a pattern and search fleets of repos to remove entire classes of issues.
SARIF and Dashboards
Export machine readable results to route owners track SLAs and brief stakeholders.
Frequently Asked Questions
How does pricing start?
Public repositories get code scanning at no cost while private repositories access features via GitHub Advanced Security licensing.
Which languages are supported?
CodeQL covers major languages with evolving query packs; see the docs for current matrices.
Can we write custom rules?
Yes build organization packs so checks reflect your frameworks and past incidents.
Will it slow CI?
Scans are incremental and configurable so teams balance depth and speed per repo.
How do we triage findings?
Use SARIF outputs code owners and auto triage to route issues to responsible teams quickly.
Tags
Compare CodeQL (GitHub)
Side by side with the tools people weigh it against.
