CodeQL vs Semgrep

From $30 per committer/month (GitHub Advanced Security, indicative)

From $40 per contributor/month (indicative)

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Free for public repositories on GitHub.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Widely used

GitHub (Microsoft) · since 2019

Widely used

Semgrep · since 2020

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Teams that want customisable static analysis and can start entirely for free.