GitHub-anchored engineering organizations, particularly those already on GitHub Enterprise that want the deepest semantic analysis on the market. Strong for security-engineering teams that can invest in custom CodeQL query development.
Non-GitHub shops (effectively unavailable), buyers wanting plug-and-play SAST without query-language investment (Snyk Code or SonarQube better), or budget-conscious buyers (GitHub Advanced Security add-on is meaningful).
Is CodeQL a trustworthy vendor?
- 2019-09-18GitHub acquires Semmle (CodeQL) from Semmle LtdAcquired semantic SAST engine; folded into GitHub Code Scanning by 2020.
- 2021-12-10CodeQL identifies Log4Shell variants (CVE-2021-44228)CodeQL queries identified Log4Shell variants in OSS; reinforced semantic-analysis credibility.
- 2024-04-15GitHub Advanced Security pricing complaints persistCustomers continue to push back on the $49 per active committer/mo add-on not being bundled with GitHub Enterprise.
What 540 reviews actually say
Synthesized from G2, Capterra, Reddit, Trustpilot. Patterns >15% prevalence shown.
Praise patterns
- Deepest semantic SAST on the market87% →
- Native GitHub integration78% →
- Free for public repositories71% →
- Strong for security-research teams51% →
Complaint patterns
- Outside GitHub effectively unavailable47% →
- CodeQL query language has a real learning curve41% →
- GitHub Advanced Security add-on pricing frustrates buyers38% ↑
- Scan times long on large repositories31% →
What buyers actually pay
246 anonymized deal disclosures · last updated 2026-05-01
| Company size | Median annual |
|---|---|
| Public repos / Community | $0 |
| Mid-market (50 to 500 committers) | $29,400 |
| Enterprise (500+ committers) | $294,000 |
Auto-verified certifications
Editorial: Strengths
- Deepest semantic analysis (data-flow, taint tracking, control-flow) in the category
- Native GitHub integration; first-class Code Scanning experience
- Free for public repositories; strong OSS-research footprint
- CodeQL query language is expressive for security researchers
- Discovered novel vulnerability classes (CVE-2021-44228 Log4Shell variants)
- Microsoft parent stability and roadmap investment
- Bundled with GitHub Actions for CI/CD execution
Editorial: Weaknesses
- Outside GitHub the product is effectively unavailable
- CodeQL query language has a real learning curve
- Scan times can be long on large repositories
- GitHub Advanced Security pricing (~$49 per active committer/mo) frustrates buyers
- Custom query development requires senior security-engineering capacity
- Free tier only for public repos; private repos require paid add-on
Key features & integrations
- +Semantic SAST across 10+ languages
- +Data-flow plus taint-tracking plus control-flow analysis
- +CodeQL query language for custom rules
- +Native GitHub Code Scanning integration
- +Free for public repositories
- +Bundled with GitHub Advanced Security (private repos)
- +OWASP Top 10, CWE Top 25 coverage
- +CodeQL CLI for local research
- +SARIF output for CI/CD integration
- +Active community on the CodeQL queries repository
Read our full ranking of Code Quality and Static Analysis
CodeQL ranks #8 in our editorial review of 10 code quality and static analysis platforms. The deep-dive covers methodology, comparison tables, decision matrix, migration scoring, and FAQs.
Read the full rankingClosest alternatives in Code Quality and Static Analysis
Contribute your verified deal price
Pricing in B2B software is opaque because vendors want it that way. Verified buyer prices fix that, anonymously. Share what you actually paid for CodeQL; we’ll add it to the verified pricing dataset on this page (with company size band only, no identifying details).
Submit anonymously