CodeQL vs SonarQube

From $30 per committer/month (GitHub Advanced Security, indicative)

From €32 per year per 100k lines of code (Developer Edition, indicative)

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

Licensed by lines of code, which makes cost predictable but expensive on large monorepos. Branch and PR analysis requires a paid edition.

Free for public repositories on GitHub.

Community Build is free and self-hosted, covering the main languages without branch analysis.

Widely used

GitHub (Microsoft) · since 2019

Category standard

Sonar · since 2007

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
• Very broad language coverage from one tool and one gate.
• Self-hosting satisfies organisations that cannot send source code externally.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• Branch and pull-request analysis — the feature most teams actually need — is paid only.
• Default rule sets are noisy until tuned to the team.
• Self-hosted instances need real resources and maintenance.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Polyglot organisations that need one quality gate across every repository.