Definition
Plain language
A tool that lets you search a codebase the way you'd search a database, looking for suspicious patterns.
As stated in the literature
GitHub's semantic code analysis engine that treats source code as a queryable database for finding vulnerability patterns.
Why it matters: It turns vulnerability hunting from grep-and-pray into systematic, repeatable queries over a project's actual code structure.
For example, a security team writes a CodeQL query that flags every place user input flows into a SQL string without escaping.
Heard on the show
“They run a static analyzer called CodeQL across the project.”Episode 014 — Why a Constrained Pipeline Beat a Full Coding Agent at Finding Bugs 30-to-1