What does github/codeql do?

CodeQL is a semantic code analysis engine and vulnerability scanning tool that treats source code as data. It utilizes a static analysis query language to define complex patterns and security vulnerabilities within a code graph database.

What are the main features of github/codeql?

The main features of github/codeql are: Graph-Relational Databases, Static Analysis Security Testing, Codebase Analysis, Security and Vulnerability Scanning, Code Analysis Query Languages, Code Analysis Pipelines, Declarative Query Languages, Code Knowledge Graphs.

What are some open-source alternatives to github/codeql?

Open-source alternatives to github/codeql include: securego/gosec — gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws.… facebook/pyre-check — Pyre is a high-performance static type checker and analysis tool for Python. It identifies type errors and ensures… bearer/bearer — Bearer is a static analysis security testing tool and privacy compliance auditor. It identifies security… microsoft/applicationinspector — ApplicationInspector is a multi-language static analysis tool designed to detect specific features and characteristics… coderaiser/putout — 🐊 Pluggable and configurable JavaScript Linter, code transformer and formatter with superpowers 💪: built-in support… jshint/jshint — JSHint is a JavaScript static analysis tool and linter designed to detect errors and enforce coding standards. It…

Codeql | Awesome Repos

Features

Graph-Relational Databases - Represents source code as a hybrid graph-relational database to enable complex structural and data flow analysis.
Static Analysis Security Testing - Provides an automated system for detecting security flaws and coding errors across large scale source code repositories using static analysis.
Codebase Analysis - Locates vulnerabilities at scale by executing queries across multiple repositories simultaneously.
Security and Vulnerability Scanning - Identifies security flaws and coding errors by executing static analysis queries across multiple codebases.
Code Analysis Query Languages - Provides a specialized query language to define complex logic and patterns for finding bugs within code.
Code Analysis Pipelines - Processes raw source code through multiple extraction and compilation stages before executing analysis queries.
Declarative Query Languages - Provides a declarative query language used to specify complex patterns and security vulnerabilities.
Code Knowledge Graphs - Builds a graph-based index of source code symbols and relationships to enable deep semantic analysis.
Logic Query Engines - Implements a query engine based on Datalog logic programming to find complex patterns in code.
Schema-Driven Data Modeling - Maps diverse programming language constructs to a fixed set of relational tables for consistent cross-language analysis.
Code Analysis Tools - Acts as a semantic engine that treats source code as data for analysis via a logic-based query language.
Custom Detection Rules - Allows users to define custom detection rules to find tailored bug patterns within a codebase.
Abstract Syntax Tree Parsing - Converts source code from multiple languages into abstract syntax trees for normalized semantic analysis.
Static Code Analysis - Enables the definition of custom patterns and logic to find specific code structures or bugs.
Interactive Query Development - Provides an interactive environment for writing and testing scanning logic with intelligent completion and navigation.
Logic Library Abstractions - Provides a system of reusable logic modules to simplify complex queries by hiding raw database schema details.
Standard Libraries - Includes standard libraries of pre-defined predicates to simplify the creation of complex analysis queries.
Structural Code Audits - Performs automated audits of code structures to identify systemic flaws and security risks.
Secure Development Lifecycles - Integrates automated code scanning into the development lifecycle to mitigate vulnerabilities before deployment.
Code Analysis Frameworks - Semantic code analysis using dataflow queries.
Code Analysis Platforms - Semantic code analysis using dataflow queries for multiple languages.

Alternative open-source pentru Codeql

Proiecte open-source similare, clasificate după numărul de funcționalități comune cu Codeql.

securego/gosec
securego/gosec
8,866Vezi pe GitHub
gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph
Go
Vezi pe GitHub8,866
facebook/pyre-check
facebook/pyre-check
7,169Vezi pe GitHub
Pyre is a high-performance static type checker and analysis tool for Python. It identifies type errors and ensures type safety without executing the program, utilizing a static type inference engine to maintain consistency across functions. The project is distinguished by an incremental type analysis engine that operates as a background daemon. This system monitors filesystem changes to re-validate only modified parts of a project, reducing the time required for repeated analysis. It also includes a static analysis security tool that uses taint analysis to track untrusted data flows and ident
OCaml
Vezi pe GitHub7,169
bearer/bearer
Bearer/bearer
2,566Vezi pe GitHub
Bearer is a static analysis security testing tool and privacy compliance auditor. It identifies security vulnerabilities, hard-coded secrets, and privacy risks in source code through static analysis and data flow tracing. The tool distinguishes itself by tracking the movement of sensitive data through code to identify leaks and by mapping personal and health-related information flows to generate evidence for privacy impact assessments. It also provides differential scanning for pull requests and uses fingerprint-based suppression to exclude known false positives from reports. The platform co
Goappseccode-qualitycompliance
Vezi pe GitHub2,566
microsoft/applicationinspector
microsoft/ApplicationInspector
4,391Vezi pe GitHub
ApplicationInspector is a multi-language static analysis tool designed to detect specific features and characteristics within source code. It utilizes a declarative JSON rules engine to identify patterns and structural tags across project directories without requiring the analyzer to be recompiled. The system distinguishes itself through a code version differ that compares two different source paths to report changes in detected features. It also provides utilities for creating and validating custom JSON-based rules, including a validation pipeline to verify syntax and identifier uniqueness.
C#
Vezi pe GitHub4,391

Vezi toate cele 30 alternative pentru Codeql

githubcodeql

Codeql

Features

Alternative open-source pentru Codeql

securego/gosec

facebook/pyre-check

Bearer/bearer

microsoft/ApplicationInspector

Frequently asked questions

Istoric stele

Alternative open-source pentru Codeql

securego/gosec

facebook/pyre-check

Bearer/bearer

microsoft/ApplicationInspector

Frequently asked questions