# CodeQL: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 25 judge labels across 1 category by 13 of 14 models. Page: https://www.gane.ai/index/it/vendors/codeql

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 0% | 7 | 12% | 25 |

## What the models said for it

- "CodeQL consistently produces the lowest false positive rate because its full semantic data-flow analysis means it only flags issues where it can trace an actual vulnerable path" (Claude Haiku 4.5, SAST)
- "SonarQube and CodeQL are the most widely adopted today, especially for web/backend teams." (GLM 4.7 FlashX, SAST)
- "CodeQL treats code as queryable data... It's free for open-source projects and integrates natively with GitHub." (MiniMax M2.5, SAST)
- "Best if your code is on public GitHub repos; requires GitHub Advanced Security license for private repos" (DeepSeek V4 Flash, SAST)

## And against it

- "CodeQL CLI, often listed as free, may not be run on private code without a paid GitHub licence" (Muse Glimmer 30B, SAST)
- "For private repos, GitHub says you need Code Security, so check that cost before choosing it." (GPT-6 Luna, SAST)
- "CodeQL doesn't support every language—for example, its documented list excludes PHP" (GPT-6 Luna, SAST)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 1 | 0 | 0 | 2 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 0 | 2 | 0 | 0 | 2 |
| Perplexity Sonar | 0 | 3 | 0 | 0 | 3 |
| Grok 4.20 | 0 | 1 | 0 | 0 | 1 |
| Mistral Small | 0 | 1 | 0 | 0 | 1 |
| DeepSeek V4 Flash | 0 | 3 | 0 | 0 | 3 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 1 | 1 | 0 | 2 |
| Kimi K2 | 0 | 3 | 0 | 0 | 3 |
| GLM 4.7 FlashX | 1 | 0 | 0 | 0 | 1 |
| MiniMax M2.5 | 0 | 2 | 0 | 0 | 2 |
| GPT-6 Luna | 0 | 1 | 0 | 2 | 3 |
| Muse Glimmer 30B | 0 | 0 | 0 | 1 | 1 |

## Sources returned with these answers

The sites and pages cited by the answers that named CodeQL, from 60 of the 64 answers that named it (only the models that return a source list).

### Domains cited

- safeguard.sh: 32
- checkmarx.com: 28
- appsecsanta.com: 26
- dev.to: 18
- semgrep.dev: 15
- community.owasp.org: 14
- corgea.com: 12
- upwind.io: 12
- deepsource.com: 10
- github.com: 10

### Pages cited

- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools: 22
- https://appsecsanta.com/sast-tools: 19
- https://dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e: 12
- https://upwind.io/glossary/best-sast-tools-static-code-scanners-compared: 12
- https://community.owasp.org/Source_Code_Analysis_Tools: 11
- https://deepsource.com/resources/static-analysis-tools: 10
- https://corgea.com/learn/best-sast-tools: 9
- https://community.owasp.org/Free_for_Open_Source_Application_Security_Tools: 8

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.