CodeQL is a semantic code analysis engine used to find vulnerabilities across codebases, with support for running queries via CLI, VS Code extension, and GitHub code scanning.
Field note
CodeQL lets you write and run queries to identify security vulnerabilities and code quality issues. It can be run via the CodeQL CLI, the VS Code extension, or GitHub code scanning, and supports custom queries and standard security queries.
Capabilities
Tags
Ways to use it
No integrations filed yet.
Product features
Includes built-in support for many libraries and frameworks, such as ASP.NET, EntityFramework, Gin, GORM, and more.
Run CodeQL queries from the command line.
Enable code scanning on GitHub to run standard CodeQL queries.
Queries are used in code scanning analyses to find problems in source code.
Process of extracting a relational representation from source code.
Guides for C/C++, C#, Go, Java, JavaScript, Python, Ruby, Rust, Swift, and GitHub Actions.
Supports C/C++, C#, GitHub Actions, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, and Swift.
Organize QL code by grouping related types, predicates, and other modules.
Supports C/C++, C#, GitHub Actions, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, and Swift.
Run queries at scale across multiple codebases.
The QL compiler resolves names to program elements.
Describe logical relations in QL programs.
A powerful query language for code analysis.
Solve puzzles to learn the basics of QL before analyzing code with CodeQL.
Output of a QL program, evaluate to sets of results.
Running queries against a CodeQL database.
Share queries to help others find vulnerabilities.
Learn key query-writing skills by solving puzzles.
Strong support for recursive predicates.
Converting query results into meaningful source code locations.
Guide to running queries as you try out the tutorials and start to develop your own queries.
Treats code as data to find vulnerabilities and errors.
Browse the classes, predicates, and modules included in the standard CodeQL libraries in the most recent release of CodeQL.
Details supported platforms and additional software requirements for running CodeQL.
Develop and run queries with autocomplete and syntax highlighting.
Find all variants of a vulnerability in codebases.