CodeQL

CodeQL is a semantic code analysis engine that lets developers query code as though it were data: a query describing a vulnerability pattern finds all its variants across a codebase. Queries are written and run in Visual Studio Code with the CodeQL extension.

CodeQL comes from Semmle, acquired by GitHub in 2019; semmle.com now redirects to GitHub. It is free for research and open source code, under the GitHub CodeQL terms.