CodeQL

CodeQL is GitHub's open-source semantic code analysis engine, published under the MIT License. It powers the code scanning features in GitHub Advanced Security and is used by security researchers worldwide to discover vulnerabilities in software. The standard libraries and queries live in the public github/codeql repository, which has accumulated over 10,000 stars and 2,000 forks since its creation in 2018.

What It Is

CodeQL treats code as data. Instead of pattern-matching on text, it builds a relational database from a codebase and lets analysts write declarative queries in the QL language to find security vulnerabilities, bugs, and other issues. This semantic approach means queries can reason about data flow, control flow, and type information across an entire program — not just surface-level syntax. The engine supports multiple languages including JavaScript/TypeScript, Java, Python, C/C++, C#, Go, Ruby, and Swift.

How It Works

The CodeQL workflow has three main stages:

• Database creation: CodeQL instruments the build process (or uses language-specific extractors) to capture a snapshot of the code as a relational database.
• Query execution: Analysts run .ql queries against the database using either the CodeQL CLI or the CodeQL extension for Visual Studio Code. Queries can be written from scratch or drawn from the standard library.
• Results review: Findings are surfaced as alerts with path information, showing exactly how data flows from a source to a vulnerable sink.

The standard query packs in the repository cover common vulnerability classes such as SQL injection, cross-site scripting, path traversal, and insecure deserialization.

Tooling and Integration

CodeQL ships with two primary developer-facing tools:

• CodeQL CLI: A command-line interface for creating databases, running queries, and generating SARIF output that can be uploaded to GitHub or other platforms. The CLI binaries are hosted in a separate repository and are licensed separately for use on closed-source code.
• CodeQL extension for Visual Studio Code: Provides syntax highlighting, IntelliSense, code navigation for the QL language, and unit test support for CodeQL libraries and queries.

Within GitHub, CodeQL is the engine behind the "CodeQL" code scanning feature available on public repositories for free and on private repositories through GitHub Advanced Security. The GitHub pricing page notes that Copilot Autofix can generate automatic fixes for 90% of alert types in JavaScript, TypeScript, Java, and Python based on CodeQL findings.

Open-Source Model and Licensing

The libraries and queries in the github/codeql repository are MIT-licensed, meaning they can be freely used, modified, and redistributed. However, the CodeQL CLI (including the underlying engine) is hosted separately and carries a different license: analyzing open-source code is free, but analyzing closed-source code requires a separate commercial license from GitHub. This split model means the query language and standard checks are fully open, while the runtime that executes them at scale is a commercial product.

Current Status

The repository is actively maintained, with the last push recorded in August 2026 and over 1,400 open issues reflecting ongoing community engagement. GitHub continues to invest in the project as the foundation of its application security product line, and the README explicitly welcomes community contributions to the standard library and query packs via pull requests.