Burp Suite vs CodeQL

From $475 per user/year (Professional)

From $30 per committer/month (GitHub Advanced Security, indicative)

Professional is inexpensive for what it does; Enterprise is quote-based by scanning agents and applications.

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

Community Edition is free but omits the scanner and rate-limits key tools.

Free for public repositories on GitHub.

Category standard

PortSwigger · since 2003

Widely used

GitHub (Microsoft) · since 2019

• The reference tool for manual application penetration testing — every security professional knows it.
• Exceptional scanner accuracy, particularly for injection classes.
• Professional Edition is remarkably good value at under $500 per year.

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Community Edition is too limited for serious automated work.
• Requires security expertise; it is not a push-button product for developers.
• Enterprise licensing is a significant step up in cost.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

Security teams and penetration testers, plus enterprises needing scheduled authenticated scanning.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.