CodeQL
by GitHub (Microsoft)
GitHub's semantic code analysis engine for finding vulnerabilities
Visit codeql.github.com Freemium
CodeQL treats code as data: it builds a database from a codebase and runs queries written in the QL language to find vulnerabilities and bugs. It powers GitHub code scanning, ships standard security query packs for many languages, and also runs locally through a CLI and VS Code extension.
Key features
- Semantic, dataflow-aware queries
- Standard security query packs
- GitHub code scanning integration
- Custom queries in QL
- CLI and VS Code extension
Similar tools
Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
OSV-Scanner
Scan dependencies for known vulnerabilities using the OSV.dev database
Trivy
Find vulnerabilities, misconfigurations, and secrets in containers and code
TruffleHog
Find and verify leaked credentials in code, history, and cloud storage
ZAP
Open-source web application security scanner and intercepting proxy
