GitHub CodeQL is a semantic code analysis engine that treats code as queryable data. It is a SAST tool that builds a database representation of your codebase, enabling queries that track data flow across functions, files, and modules.
Natively integrated into GitHub Advanced Security, CodeQL powers code scanning for millions of repositories. According to GitHub’s Octoverse reports, code scanning has identified and helped fix millions of vulnerabilities across public repositories since CodeQL’s launch. It is free for public repositories on GitHub.
What is CodeQL?
CodeQL works differently from pattern-matching SAST tools. Rather than searching for text patterns, CodeQL compiles source code into a relational database that captures the semantic structure: variables, functions, control flow, data flow, and type information.
Security researchers write queries in the CodeQL query language to find vulnerabilities by describing the characteristics of insecure code. The query language resembles SQL with object-oriented extensions. For example, CodeQL can trace user input from an HTTP request through multiple transformation functions to a SQL query, identifying injection vulnerabilities that pattern-based tools miss.
Key features
Data flow and taint tracking
The taint tracking engine follows potentially dangerous data through your codebase. Starting from sources (user input, file reads, network data) and ending at sinks (database queries, command execution, file writes), CodeQL identifies paths where untrusted data reaches sensitive operations without sanitization.
Custom query development
Security teams can write custom CodeQL queries for organization-specific requirements:
- Detecting use of banned functions or deprecated APIs
- Enforcing authentication checks on sensitive endpoints
- Finding missing input validation patterns
- Identifying violations of internal security standards
GitHub integration
On GitHub repositories, CodeQL runs automatically through GitHub Actions. Results appear directly in pull requests as security alerts. The integration includes automatic analysis on push and PR events, inline annotations showing vulnerability locations, suggested fixes, and security overview dashboards for organizations.
security-and-quality suite covers both security vulnerabilities and code quality issues. The security-extended suite adds additional queries. Custom query packs can be published and shared across organizations.Getting started
.github/workflows/codeql.yml workflow file.codeql database create, and develop queries using the VS Code CodeQL extension.When to use CodeQL
CodeQL is the natural choice for teams already on GitHub that want deep semantic analysis without additional vendor relationships. The data flow analysis catches injection vulnerabilities, authentication bypasses, and security logic flaws that pattern-based tools miss.
The query language has a learning curve, though the standard query packs cover most common vulnerability types. Teams not on GitHub can still use CodeQL through the CLI, but lose the native pull request integration.
For faster custom rule development or broader language support, consider Semgrep. For enterprise features and commercial support, Checkmarx or Veracode may be more appropriate. Our Semgrep vs CodeQL guide compares these two popular open-source options in depth.
Note: Replaces LGTM.com which was deprecated and merged into CodeQL
