Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

GitHub CodeQL review

Freemium#3 of 26 in SAST ToolsStatic Application Security Testing SoftwareRuby Static Analysis ToolsBoot Manager Software+3 more

Deep SAST for GitHub workflows, with free public-repository scanning.

9.0/10Editor score
Visit GitHub CodeQL
GitHub CodeQL9.0 Visit GitHub CodeQL

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

GitHub CodeQL is a semantic static-analysis engine for finding security vulnerabilities, coding errors, and other issues in source code. It represents code as data and queries that representation, giving development and security teams a way to scan repositories, pull requests, and CI workflows. It is particularly suited to GitHub-centric teams that want code-scanning alerts in GitHub, while also supporting local analysis through the CodeQL CLI and Visual Studio Code.

Pricing is split between public and eligible private repositories. Code scanning with CodeQL is available free of charge for public repositories. For eligible private repositories, GitHub Code Security starts at $30 per active committer per month, billed monthly, with billing based on unique active committers. The product connects with GitHub Actions, Azure DevOps, external CI systems, and Visual Studio Code. Teams can generate and upload SARIF results, integrate the CodeQL CLI into external CI, and view findings through GitHub code-scanning alerts.

Its standout capability is query-based analysis: teams can author custom CodeQL queries alongside the published vulnerability and coding-error detection. Pull-request scanning, CI/CD integration, IDE support, and coverage across nine listed programming-language entries support workflows from development through review. Choose CodeQL when semantic analysis, custom rules, and GitHub workflow integration are priorities. Teams that need private-repository coverage should account for the per-active-committer license, while public repositories receive the strongest pricing advantage.

GitHub CodeQL pros and cons

  • Where it wins
    • Semantic queries detect vulnerabilities and coding errors.
    • Pull-request, GitHub Actions, and external CI scanning.
    • Custom queries and SARIF support for tailored analysis.
  • Where it doesn't
    • Private-repository scanning requires paid GitHub Code Security.
    • Paid pricing is based on unique active committers.
    • The feature set is centered on source-code analysis.

GitHub CodeQL fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update