Alternatives to CodeQL
A semantic code analysis engine from GitHub that lets you query source code to find vulnerabilities. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
CodeQL
A semantic code analysis engine from GitHub that lets you query source code to find vulnerabilities.
Replacements
Listings that take over the same core job as CodeQL.
Semgrep
Find code patterns and potential problems with static analysis.
Semgrep runs custom or shared static analysis rules in development workflows and is open source, with rule quality and language support affecting coverage.
SonarQube
A static code analysis platform that flags bugs, maintainability issues and security vulnerabilities.
SonarQube is a self-hosted or cloud code analysis platform tracking bugs, technical debt and security issues with CI/CD and IDE integration.
Snyk
A hosted developer security platform that scans code and applications for vulnerabilities.
Snyk is a hosted platform scanning code, dependencies and containers with a free starter plan, though direction is aimed mainly at enterprises.
Bandit
A command-line static analyser that finds common security issues in Python code.
Bandit is an open-source command-line analyser focused only on security issues in Python code, narrower than CodeQL's multi-language querying.
Similar software
Related functionality, not a direct replacement.
TruffleHog
Find exposed credentials in repositories and other data sources.
Gitleaks
Scans Git repositories, files and pipelines for leaked secrets.
detect-secrets
A command-line tool from Yelp that detects and prevents secrets such as keys being committed to code.
