CodeQL
Ranked 6 of 12 static analyzers by recommenders
Developers recommend it for accurate reports tied to specific code paths; the most common caveat is false positives, and some find it heavy on large repos.
Developers recommend it for accurate reports tied to specific code paths; the most common caveat is false positives, and some find it heavy on large repos.
19 people gave an opinion
- recommend it
- 9
- criticize it
- 10
- approval share
- 47%
Recommended in 3 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 0.9 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Accurate, specific vulnerability reports
“The functionality in CodeQL that I have found useful tends to accompany each reported vulnerability with a specific code path”
Comment from 21 Feb 2026 in “Turn Dependabot Off” “the first thing that really impressed me about CodeQL was how accurate its reports were with some quite old Django code”
Comment from 21 Feb 2026 in “Turn Dependabot Off” “a specific claim about specific code that is demonstrably true”
Comment from 21 Feb 2026 in “Turn Dependabot Off” Finds real vulnerabilities in code
“So, CodeQL found a vulnerability in your code”
Comment from 21 Feb 2026 in “Turn Dependabot Off” “genuinely impressed me recently”
Comment from 21 Feb 2026 in “Turn Dependabot Off”
What people warn about
Each mark is one comment
Too many false positives
“we just got a bunch of false positives for not validating a UUID url path param”
Comment from 21 Feb 2026 in “Turn Dependabot Off” “CodeQL seems to raise too many false-positives in my experience.”
Comment from 21 Feb 2026 in “Turn Dependabot Off” Heavy on laptops and large repos
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos”
Comment from 2 Feb 2026 in “RMA – Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC” “Existing scanners like CodeQL are too heavy to run locally on my 8GB laptop.”
Comment from 4 Mar 2026 in “Show HN: The Janitor – A 58MB Rust static analyzer to block AI-generated PR slop”
Other static analyzers people recommend
The four most recommended other static analyzers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| zizmor | 19 | 1 | 95% | 6 | — | Approved |
| Semgrep | 14 | 10 | 58% | 7 | — | — |
| clang-tidy | 14 | 4 | 78% | 6 | — | Approved |
| PHPStan | 11 | 0 | 100% | 7 | — | Approved |
| CodeQLThis page | 9 | 10 | 47% | 3 | — | — |
What people said
23 of the 24 comments that mention it, newest first. Each links to the original comment.
“it's a modern relational query language based on Datalog”
“Github is in no hurry to add modules support to CodeQL”
“Existing scanners like CodeQL are too heavy to run locally on my 8GB laptop.”
“it lagged behind the official releases by about two months”
“So, CodeQL found a vulnerability in your code”
“the first thing that really impressed me about CodeQL was how accurate its reports were with some quite old Django code”
“the vagaries of the dual licensing discourages a lot of teams working on commercial projects”
“we just got a bunch of false positives for not validating a UUID url path param”
“I don't doubt CodeQL claims can be demonstrably true, that's still coherent with Rice's theorem. However it does mean you'll have false negatives”
“more recently, our team has been increasingly frustrated by the thing to the point of turning it off”
“The functionality in CodeQL that I have found useful tends to accompany each reported vulnerability with a specific code path”
“a specific claim about specific code that is demonstrably true”
“If dataflow is not provably connected from source to sink, an alert is impossible.”
“The CodeQL CLI is developed as an open-source project and can run CodeQL basically anywhere.”
“CodeQL seems to raise too many false-positives in my experience.”
“genuinely impressed me recently”
“SAST tools find SQL injection and XSS. They cant find a booking endpoint”
“catches the obvious stuff but misses AI-specific patterns”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos”
“the rules are opportunistic, not real”
“sub-par products SonarQube and CodeQL that see massive overuse”
“which is designed to scan for semantic patterns in a codebase”
“It makes it so easy to use CodeQL”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.