# CodeQL

9 Hacker News commenters recommended CodeQL and 10 criticized it, November 2025 to November 2026. It was recommended in 3 of 13 months.

**Verdict:** Developers recommend it for accurate reports tied to specific code paths; the most common caveat is false positives, and some find it heavy on large repos.

## Why people recommend it

- Accurate, specific vulnerability reports (3 comments): "The functionality in CodeQL that I have found useful tends to accompany each reported vulnerability with a specific code path" ([source](https://news.ycombinator.com/item?id=47099788)) "the first thing that really impressed me about CodeQL was how accurate its reports were with some quite old Django code" ([source](https://news.ycombinator.com/item?id=47102231)) "a specific claim about specific code that is demonstrably true" ([source](https://news.ycombinator.com/item?id=47099713))
- Finds real vulnerabilities in code (2 comments): "So, CodeQL found a vulnerability in your code" ([source](https://news.ycombinator.com/item?id=47102339)) "genuinely impressed me recently" ([source](https://news.ycombinator.com/item?id=47098473))

## What people warn about

- Too many false positives (2 comments): "we just got a bunch of false positives for not validating a UUID url path param" ([source](https://news.ycombinator.com/item?id=47101731)) "CodeQL seems to raise too many false-positives in my experience." ([source](https://news.ycombinator.com/item?id=47099262))
- Heavy on laptops and large repos (2 comments): "tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos" ([source](https://news.ycombinator.com/item?id=46854089)) "Existing scanners like CodeQL are too heavy to run locally on my 8GB laptop." ([source](https://news.ycombinator.com/item?id=47242860))

## Alternatives hackers recommend

- [zizmor](https://hackerapproved.com/p/zizmor.md): 19 recommend
- [Semgrep](https://hackerapproved.com/p/semgrep.md): 14 recommend
- [clang-tidy](https://hackerapproved.com/p/clang-tidy.md): 14 recommend
- [PHPStan](https://hackerapproved.com/p/phpstan.md): 11 recommend
- [SonarQube](https://hackerapproved.com/p/sonarqube.md): 10 recommend

## Where to get it

- [Visit the official site](https://codeql.github.com/)

## Cite as

Hacker Approved, "CodeQL", https://hackerapproved.com/p/codeql/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).