Semgrep vs CodeQL: Static Analysis (SAST) Compared
Both are SAST tools that scan code for security issues. Semgrep is fast and easy to write rules for using a pattern-matching syntax; CodeQL does deep semantic, dataflow-based analysis with a more powerful but harder query language.
Semgrep and CodeQL both find vulnerabilities in source code, but they sit at different points on the speed-versus-depth curve. Semgrep matches patterns quickly across many languages; CodeQL treats code as a database you query with rich dataflow analysis. Here is the honest comparison.
| Semgrep | CodeQL | |
|---|---|---|
| Analysis type | Pattern matching (+ some dataflow) | Deep semantic dataflow (taint) |
| Rule language | YAML-like, easy to write | CodeQL query language (steeper) |
| Speed | Fast | Slower (builds a code database) |
| Language support | Broad, many languages | Broad, compiled + interpreted |
| Licensing | OSS core + paid platform | Free for OSS/public; terms for private use |
| GitHub integration | Action available | Native code scanning |
Speed and rule authoring
Semgrep is easy to adopt: rules look like the code you want to match, and scans are fast, so it fits inline PR checks and custom org rules well. Its analysis is lighter on interprocedural dataflow than CodeQL, so some deep vulnerabilities need more work to express. CodeQL query authoring is more involved but expresses complex taint-tracking that catches issues pattern matching misses.
Depth and coverage
CodeQL builds a semantic database of the code and runs powerful dataflow queries, which excels at finding injection and data-flow bugs across functions and files. That depth costs time and a build step for compiled languages. Semgrep trades some depth for speed and simplicity, and its large community ruleset covers many common issues out of the box.
In CI
Both run as CI checks and upload findings (SARIF) to code scanning. Run Semgrep for fast feedback and custom rules; add CodeQL for deeper scheduled or PR scans. Many teams use both: Semgrep on every push, CodeQL on a schedule or on default-branch PRs.
The verdict
Choose Semgrep for fast scans and easy custom rules; choose CodeQL for deep, dataflow-based analysis that catches subtler vulnerabilities. Check current licensing for your use case, and consider running both for layered coverage.