Where the choice differs
| StaticCodeAudit | CodeQL | |
|---|---|---|
| PHP support | Yes — one of 8 languages | No |
| Build step required | None — scans source directly | Yes for compiled languages (Java, C/C++, C#, Go, Swift) |
| ISO 27001 / ASVS / WCAG matrices | Built-in | Not bundled — CWE tags only |
| Self-contained HTML report | Yes — 26+ charts, brand-able, works offline | SARIF surfaced in GitHub UI — no standalone artifact |
| Works fully outside GitHub | Yes — standalone binary, any git host or none | CLI exists, but the ecosystem (alerts UI, PR annotations) is GitHub-native |
| Languages See real detection benchmarks → | 8 (Python, JS/TS, HTML, Java, C#, PHP, YAML, Dockerfile) | 8 (C/C++, C#, Go, Java/Kotlin, JS/TS, Python, Ruby, Swift) |
| Cost on private repos | €990 → €30 K+/year flat | $30/committer/month (GitHub Code Security) |
| Semantic dataflow depth | AST + taint rules, cross-file for Python and Java | Full interprocedural dataflow — the deeper engine |
Comparison based on CodeQL CLI and GitHub Code Security pricing as of August 2026. Sources: codeql.github.com, github.com/github/codeql, GitHub pricing page.
Pick StaticCodeAudit if…
- ✅ Any part of your stack is PHP — CodeQL does not analyze it at all.
- ✅ You want a scan with zero build step — no compiling C#, Java or Go just to get a database to query.
- ✅ You need a compliance binder (ISO 27001 Annex A, ASVS, WCAG) ready to hand to an auditor, not just CWE-tagged alerts.
- ✅ Your repos are not on GitHub, or you need results as a portable artifact rather than a platform-specific alerts feed.
Pick CodeQL if…
- ✅ Your project is public on GitHub — CodeQL is free there and results appear directly on pull requests.
- ✅ You need the deepest semantic dataflow analysis available and have the engineering time to write custom QL queries.
- ✅ Your stack is entirely in CodeQL's 8 supported languages and you can afford the build-step overhead for compiled ones.
- ✅ You already standardize on GitHub Advanced Security for secret scanning and dependency review, and want SAST in the same alerts feed.
What CodeQL does well
- • Genuine semantic dataflow analysis — traces tainted values across function calls, not just pattern matching.
- • Free on public repositories via GitHub code scanning (GitHub Actions), no license needed.
- • Large open query library maintained by GitHub Security Lab and the community at github/codeql, credited with finding real-world CVEs in major open-source projects.
- • Native GitHub integration — results surface directly as code scanning alerts on pull requests, no separate report to distribute.
- • QL query language is genuinely powerful for writing custom, precise semantic queries once you learn it.
Architecture in one sentence each
StaticCodeAudit
A single binary, runs offline, ships 708 curated rules already mapped to CWE / WCAG / ISO 27001 / ASVS / NIST CSF. You point it at a source tree — no compilation, no database extraction — and get an HTML report ready to attach to an audit binder.
CodeQL
A semantic analysis engine: it first builds a CodeQL database from your code — for compiled languages this means actually compiling the project — then runs QL queries against that database for genuine interprocedural dataflow tracing. Free and turnkey on public GitHub repos via code scanning; on private repos or outside GitHub, it requires the GitHub Advanced Security license or manual CLI orchestration.
The real choice is between « I want the deepest possible dataflow engine and I'm on GitHub, in a supported compiled or scripting language » (CodeQL) and « I want zero build step, PHP coverage, and audit-ready compliance matrices out of the box » (StaticCodeAudit). Some teams reasonably run both — CodeQL on public GitHub repos for its depth, StaticCodeAudit on everything else including PHP services and offline/air-gapped environments.
Concrete pricing scenarios (annual)
CodeQL is free on public GitHub repositories via code scanning. On private repositories it requires GitHub Advanced Security — specifically the GitHub Code Security add-on at $30/committer/month (as of the 2025 GHAS unbundling). StaticCodeAudit is a flat annual fee at every tier — no seat counting, and it works the same whether your repo is public, private, or not on GitHub at all.
| Scenario | StaticCodeAudit | CodeQL |
|---|---|---|
| Solo / open-source maintainer 1 developer, public repo |
990 €/year (Solo tier, curated + audit report) | Free — CodeQL code scanning on public repos |
| Startup / small team 10 developers, private repos, ~500 K SLOC |
3 990 €/year (Team, flat) | $30 × 10 × 12 = $3 600/year (GitHub Code Security) |
| Mid-market / regulated 30 developers, private repos, ~2 M SLOC |
11 990 €/year (Team Plus, flat) | $30 × 30 × 12 = $10 800/year (GitHub Code Security) |
GitHub Code Security pricing: github.com/pricing, effective after the 2025 GitHub Advanced Security unbundling (GitHub Code Security + GitHub Secret Protection sold separately). Conversion 1 € ≈ 1.07 USD (May 2026 indicative).
Frequently asked questions
Is CodeQL really free?
Free on public repositories via GitHub code scanning — that includes the full query library and Actions integration. On private repositories, it requires the GitHub Code Security add-on ($30/committer/month as of the 2025 GitHub Advanced Security unbundling), or manual use of the CodeQL CLI with community query packs outside GitHub's billed product.
Does CodeQL support PHP?
No. CodeQL's supported languages are C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, and Swift. PHP is not among them and has not been added as of this writing. If any part of your stack is PHP, it goes unscanned by CodeQL entirely — StaticCodeAudit covers it as one of its 8 languages.
Why does CodeQL need a "build step" for some languages?
CodeQL analyzes compiled languages (Java, C/C++, C#, Go, Swift) by actually compiling the project and observing the build to construct its queryable database — this is how it achieves precise semantic understanding, but it means the analysis can fail or need reconfiguration whenever the build itself breaks. Interpreted languages (Python, JavaScript/TypeScript, Ruby) don't need a real build, only source extraction. StaticCodeAudit never requires a build step for any of its 8 languages, including compiled ones like Java and C#.
Is CodeQL's analysis actually deeper than StaticCodeAudit's?
For the languages and vulnerability classes it targets, yes — CodeQL's interprocedural dataflow tracing is one of the most capable engines available, and GitHub Security Lab has used it to find real CVEs in major open-source projects. StaticCodeAudit uses AST and taint-based rules with cross-file tracing currently for Python and Java, which covers the vulnerability classes mapped to its 708 rules but is not a general-purpose query engine the way QL is.
Can I use both?
Yes, and it's a reasonable setup: CodeQL on public GitHub repos for its analysis depth and native PR integration, StaticCodeAudit for PHP services, private repos where you want to avoid per-committer billing, offline/air-gapped environments, or whenever you need a compliance-ready HTML report rather than a GitHub-native alerts feed.
See what 708 curated rules + matrices look like
Open the live demo report — generated on a real codebase, all charts interactive, ISO/ASVS/WCAG matrices included.
Open the live report Book a walkthrough