GitHub CodeQL vs NaiveSystems Analyze
GitHub CodeQL
codeql.github.com
NaiveSystems Analyze
naive.systemsSide by side
| Figure | GitHub CodeQL | NaiveSystems Analyze |
|---|---|---|
| Price from | $30/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 2 |
| Spec score · SAST Tools | 8.5 (#5) | 8.4 (#6) |
| GitHub Actions | The standard way to run CodeQL queries on a GitHub-hosted repository is to enable code scanning with GitHub Actions. | The project provides an official GitHub Actions workflow for Google C++ Style checking. |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | NaiveSystems Analyze is a static analysis tool for detecting code security issues and checking compliance with functional safety and coding standards. |
| Security analysis | CodeQL is designed to automate security checks and help security researchers perform variant analysis. | The vendor says its context-sensitive, interprocedural data-flow analysis detects tainted data, buffer overflows, and other vulnerable practices. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
NaiveSystems Analyze
NaiveSystems Analyze is a static analysis tool for finding security issues in source code and checking compliance with functional safety and coding standards. It uses syntax trees, symbolic execution, and context-sensitive interprocedural data-flow analysis to identify issues such as null pointer dereferences, memory leaks, tainted data, and buffer overflows. Filters, suppressions, and baselines help teams focus on critical defects, while diagnostics are intended to help address severe issues. Listed standards include MISRA C:2012, MISRA C++:2008, AUTOSAR C++14, the complete CERT C and C++ rule set, CWE Top 25, and OWASP Top 10 coverage. The displayed DevOps integrations include GitHub, GitLab, Gerrit, Jenkins, and Buildbot. A free, open-source runner and containerized analyzers support on-premises deployment; the vendor says this keeps source code and privacy under the user's control. The Free plan supports GCC and Clang, up to 100,000 lines of code, and up to four CPUs on one node. Windows and macOS support is for Enterprise customers. The vendor says analyzers for languages beyond C and C++ are in development.