GitHub CodeQL vs SpotBugs
GitHub CodeQL
codeql.github.comSpotBugs
spotbugs.github.ioSide by side
| Figure | GitHub CodeQL | SpotBugs |
|---|---|---|
| Price from | $30/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 5 | 1 |
| Spec score · Static Analysis Tools | 8.5 (#8) | 7.3 (#24) |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | SpotBugs uses static analysis to look for bugs in Java code. |
| Security analysis | CodeQL is designed to automate security checks and help security researchers perform variant analysis. | The manual includes a security bug category and instructions for integrating Find Security Bugs with the Maven plugin. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
SpotBugs
SpotBugs has no write-up on Specifiction yet; its figures are above.