CodeSonar vs GitHub CodeQL
CodeSonar
adacore.com
GitHub CodeQL
codeql.github.comSide by side
| Figure | CodeSonar | GitHub CodeQL |
|---|---|---|
| Price from | — | $30/mo |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 5 |
| Spec score · Static Application Security Testing Sast | 8.1 (#5) | 8.5 (#4) |
| Spec score · Static Application Security Testing Software | 8.1 (#7) | 8.6 (#3) |
| Spec score · SAST Tools | 8.1 (#8) | 8.5 (#5) |
| Purpose | CodeSonar is a static application security testing solution that finds security and quality defects in code. | CodeQL is a language and toolchain for code analysis that treats code as data. |
| Security coverage | Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++, and DISA STIG. | CodeQL 2.26.2's Default suite contains 497 security queries covering 170 CWEs, while Extended adds 131 queries covering 32 more CWEs. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
CodeSonar
CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.