Side by side
GitHub CodeQL vs Microsoft DevSkim
Both stand on static application security testing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan ExtensionLinuxMac+3
Visit GitHub CodeQL Free plan APIExtensionLinux+3
DevSkim offers IDE, CLI, and library options for security linting, with custom rules and several result formats. Developers should note the limited support channels and use private reporting for vulnerabilities.
Visit Microsoft DevSkimThe facts
| GitHub CodeQL | Microsoft DevSkim | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Extension, Linux, Mac, Self-hosted, Web, Windows | API, Extension, Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | See the plans | Free or on request |
| Plans published | 4 | 1 |
| Maker | Not published | Not published |
| Website | codeql.github.com | github.com |
| On static application security testing software | #7 of 25 | #11 of 25 |
GitHub CodeQL: what it does well
Microsoft DevSkim: what it does well
- Free and MIT-licensed
- CLI analyzes files and directories across major desktop platforms
- Supports SARIF, JSON, and text output
- Can apply suggested fixes and add suppressions
- Extensions listed for Visual Studio and Visual Studio Code
What to know first
- Support is limited to GitHub issues and project wiki resources
- Vulnerability reports should not be posted in public GitHub issues
Alternatives to GitHub CodeQL Alternatives to Microsoft DevSkim The whole list