CodeQL
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
2recommend
2warn against
Nov 4, 2025first mention
Oct 17, 2026latest mention
Why people recommend it
“which is designed to scan for semantic patterns in a codebase”
“It makes it so easy to use CodeQL”
Caveats and dissent
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
Often compared with
Who recommends it in their own words
From the makers not counted in the ranking
“CodeQL builds a full semantic database including types and dataflow from source code”
“The CodeQL CLI is developed as an open-source project and can run CodeQL basically anywhere.”
Product Director for detection & remediation engines, including CodeQLon “Turn Dependabot Off”
Threads where it came up
- Turn Dependabot Off 3 mentions
- Ask HN: How are you all ensuring your AI code isn't slop? 1 mention
- RMA – Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC 1 mention
- Show HN: Bloodhound – Grey-box attack-path discovery in Rust/Go/C++ binaries 1 mention
- Claude Opus 4.5 1 mention
- Tgr- TUI for GitHub 1 mention
Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 8
“CodeQL scanning”
“CodeQL has been disappointing with Kotlin”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
We don't auto generate issues exploits but rather find the already existing exploits and break them further to test the full depth of the vuln. We use some aspects of graph DB but its not quite the same thing. This differs from Mend and CodeQL because they focus on deep semantic analysis or SCA, We use parallel detection systems for hybrid, holistic analysis by combining advanced static testing, execution modeling, a
“which is designed to scan for semantic patterns in a codebase”
“it's scanned by CodeQL in Github for security”
“It makes it so easy to use CodeQL”
“I use it for static analysis”