Semantic code analysis engine by GitHub that finds vulnerabilities using database-like queries over code.
Category
Security
Subcategory
Vulnerability Scanning
Free Tier
Free for open source
Paid Plans
Included in GitHub Advanced Security
API Cost
Not available yet
Web AppAPIVS Code ExtensionCLI
CodeQL Trust & Security Report
Certifications, AI-training posture, and security controls, with sourced proof.
●SOC 2 Type II●ISO/IEC 27001:2022●CSA CAIQ (Cloud Security Alliance CAIQ)●CSA STAR Level 2●PCI DSS●GDPR
Verified against CodeQL's own trust and security pages. See the full report for sourced proof →
Region
GitHub operates data centers with processing in multiple regions. Private repositories are generally stored in the user's selected region.
Trains on Data
Yes
Self-hostable
No
Code vulnerability scanningSecurity analysisOpen source securityCI/CD security
// MORE IN VULNERABILITY SCANNING
GitGuardianSecurityVulnerability ScanningVerified
#secrets detection#credential scanning
SemgrepSecurityVulnerability ScanningVerified
#static analysis#sast
VeracodeSecurityVulnerability ScanningVerified
#application security#sast