Bandit vs GitHub CodeQL
Bandit
github.com
GitHub CodeQL
codeql.github.comSide by side
| Figure | Bandit | GitHub CodeQL |
|---|---|---|
| Price from | Free | $30/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 5 |
| Spec score · SAST Tools | 9.0 (#1) | 8.5 (#5) |
| Spec score · Static Application Security Testing Software | 9.0 (#1) | 8.6 (#3) |
| Purpose | Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes. | CodeQL is a language and toolchain for code analysis that treats code as data. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
Bandit
Bandit is free software for finding common security issues in Python source code. It builds an abstract syntax tree from scanned files and runs plugins against that tree, then produces a report. A JSON baseline can exclude findings that a team considers non-issues. The project is distributed through PyPI and recommends installation with pip. It runs on Linux and macOS and can be used in self-hosted environments. Optional installation extras add TOML support, the bandit-baseline command-line tool, and SARIF output formatting. Documentation describes pre-commit configuration and integrations with Visual Studio Code, Sublime Text, Vim, Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. A published container image supports amd64, arm64, armv7, and armv8 architectures. The project says images are signed with Sigstore Cosign and provides source-verification instructions. Bandit is licensed under Apache License 2.0, with support links to GitHub issues and Discord.
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.