CodeQL vs GitGuardian

From $30 per committer/month (GitHub Advanced Security, indicative)

Free tier available

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

Free tier covers small teams entirely; business pricing is quote-based per developer.

Free for public repositories on GitHub.

Free for individuals and teams up to 25 developers.

Widely used

GitHub (Microsoft) · since 2019

Widely used

GitGuardian · since 2017

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Validity checking distinguishes a live credential from a revoked one, which transforms triage priority.
• Scans full commit history, where most leaked secrets actually live.
• Free for teams up to 25 developers.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• Secrets scanning only — not a general security platform.
• Historical scans on old repositories produce a large initial backlog.
• Requires repository access, which needs a security review of its own.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Any organisation with more than a handful of repositories and no secrets scanning today.