CodeQL is a powerful static analysis tool developed by Semmle (acquired by GitHub in 2019) CodeQL uses data flow analysis and taint analysis to find code errors, check code quality and identify vulnerabilities. CodeQL queries are open-source, and anyone can create and contribute to CodeQL.
Table of contents
Recapping the fundamentalsCommon uses of CodeQL for security research and application securityCodeQLCode scanning with CodeQLCodeQL databasesQL query language—writing your own CodeQL queryOther resourcesConclusionSort: