SAST tools compared: SonarQube, Semgrep, CodeQL and Snyk

Your small engineering team is choosing a static application security testing (SAST) tool, or trying to work out whether the one it already pays for is pulling its weight. The contenders are SonarQube, Semgrep, GitHub CodeQL and Snyk Code, with a short note on Bearer. For each you get the current product names, what the free tier really includes, how it runs in CI, where false positives come from, and a setup I would recommend for a team of under ten developers.

All prices and free-tier limits below were checked on 11 November 2026 against the vendors’ own pages. They change often, so check again before you sign anything.

What SAST covers, and what it does not

A SAST tool reads your source code without running it. Simple rules match dangerous calls, such as eval on user input. Taint analysis goes further: it follows data from a source (a request parameter) to a sink (a SQL query or shell command) and reports the path. How far that tracking reaches, inside one function, across functions, or across files, is the biggest quality difference between the free and paid tiers below.

SAST does not find vulnerable dependencies (that is software composition analysis, covered in dependency scanning tools compared), and it is weak on business logic such as “can user A read user B’s invoice”. That is where an agent-led review helps, which I cover in security review skills for AI coding agents.

SonarQube

Sonar has renamed its products, so older guides use names that no longer exist. The current names are:

• SonarQube Community Build: free, self-managed and open source (LGPL-3.0 on GitHub).
• SonarQube Server: the self-managed commercial editions, Developer, Enterprise and Data Center. Priced per instance, per year, by lines of code. The pricing page shows no list price.
• SonarQube Cloud: the hosted service, with Free, Team and Enterprise plans.

The Community Build is where people get caught out. Sonar’s own edition comparison says it lacks branch and pull request analysis, pull request decoration and taint analysis, processes one analysis at a time, and does not cover C, C++, Objective-C, Dart or Swift. It analyses your main branch for quality issues and simpler security rules. That is useful, but it is not a security gate on pull requests.

Developer Edition adds branch and PR analysis, taint analysis with cross-function and cross-file tracking for Java, C#, JavaScript, TypeScript, Python, PHP, Kotlin, Go and VB.NET, and secrets detection across 400+ patterns. Sonar lists 40 languages for Developer and 48 for Enterprise.

SonarQube Cloud’s Free plan covers private projects up to 50k lines of code, unlimited public projects and up to five organisation members. It analyses only the main branch, and pull requests only when they target the main branch. Team starts at $34 a month for up to 100k lines of code and adds full branch and PR analysis. Advanced Security (SCA and advanced SAST) is a separate subscription.

SonarQube’s strength is the quality gate: one dashboard that combines bugs, code smells, coverage, duplication and security issues, and a pass or fail on each pull request. If you want that, it is the best-known option. If you only want security findings, the tools below are more focused.

SonarQube Cloud in GitHub Actions

The scan action README asks you to pin a release tag or commit SHA. v8.4.1 is the latest release as of 11 November 2026:

name: SonarQube
on:
  push:
    branches: [main]
  pull_request:

jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0  # README recommends full history for more relevant reporting
      - uses: SonarSource/sonarqube-scan-[email protected]
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

With a sonar-project.properties file at the repository root:

sonar.organization=your-org
sonar.projectKey=your-org_your-repo
sonar.sources=src

For SonarQube Server, drop sonar.organization and set SONAR_HOST_URL from a repository or organisation variable.

Semgrep

Semgrep has two layers, and the licence detail matters.

Semgrep Community Edition (CE) is the open source engine, licensed LGPL-2.1. It needs no account. Its analysis is deliberately shallow: Semgrep’s docs describe single-function taint analysis and cross-function constant propagation within a single file. It is fast, and it “can’t track data beyond a single function or file”. The rules Semgrep maintains, Community and Pro, are under the Semgrep Rules License v1.0, which allows internal business use but bars vendors from using them in competing products or SaaS offerings. Using CE in your own pipeline is fine.

Semgrep AppSec Platform adds Semgrep Code (cross-function and cross-file analysis with Pro rules), Supply Chain, Secrets, triage and AI-assisted fixes. Its plans:

• Free: $0 for up to 10 contributors and 10 private repositories. Includes Code and Supply Chain, cross-file analysis with Pro rules and 60 AI credits.
• Teams: Code $30, Supply Chain $30 and Secrets $15 per contributor per month, up to 500 private repositories.
• Enterprise: custom pricing.

A contributor is anyone who made at least one commit to a scanned private repository in the past 90 days.

That free tier is the most generous security-focused offer in this comparison for a small private codebase. Ten contributors with cross-file analysis covers a lot of early-stage teams.

Semgrep CE in GitHub Actions

This follows Semgrep’s sample CE config, with --error added so the job fails when there are findings:

name: Semgrep CE scan
on:
  pull_request: {}
  workflow_dispatch: {}
  push:
    branches: ["master", "main"]
  schedule:
    - cron: '20 17 * * *'

permissions:
  contents: read

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v6
      - run: semgrep scan --config auto --error

Two points. --config auto pulls rules from the Semgrep server, and the CLI reference says metrics are sent whenever the config pulls from the server. If that matters to you, pin a local rules directory instead. To see only new findings on a pull request, --baseline-commit hides results that already exist at a given commit. If you use the AppSec Platform, swap the last line for semgrep ci and set SEMGREP_APP_TOKEN from a secret.

Because the CE container is just a CLI, the same command works in GitLab CI or a Jenkins agent with Docker.

GitHub CodeQL and code scanning

CodeQL is GitHub’s semantic analysis engine. It builds a database of your code and runs queries over it, which gives it deep data-flow tracking. It supports C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflow files.

Pricing is the deciding factor:

• Public repositories: CodeQL, Copilot Autofix, third-party SARIF upload and the dependency review action are free.
• Private repositories: you need GitHub Code Security at $30 per active committer per month. GitHub Secret Protection is a separate $19 per active committer per month. Since 1 April 2025 these replaced the single GitHub Advanced Security bundle, and GitHub Team customers can buy them as well as Enterprise customers.

Code scanning through Actions also consumes GitHub Actions minutes.

You can turn on default setup from the repository’s security settings with no workflow file, or use advanced setup for a workflow you control. One date to note: CodeQL Action v3 will be deprecated in December 2026. Default setup moves to v4 automatically. If you have an advanced setup workflow, change every github/codeql-action/*@v3 to @v4 now.

CodeQL advanced setup

Trimmed from GitHub’s current starter workflow for a JavaScript and Python repository:

name: "CodeQL Advanced"
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '30 2 * * 1'

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
            build-mode: none
          - language: python
            build-mode: none
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          # queries: security-extended
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

Results appear in the repository’s Security tab and as pull request annotations. Uncomment queries: security-extended to run a wider set of queries, which means more results to triage.

Snyk Code

Snyk Code is Snyk’s SAST product, sold alongside Snyk Open Source, Container and IaC. The CLI is simple:

snyk auth
snyk code test --severity-threshold=high --sarif-file-output=snyk-code.sarif

--severity-threshold accepts low, medium or high for Snyk Code. The SARIF file can be uploaded to GitHub code scanning.

The Free plan allows 100 Snyk Code tests a month across 5 projects. Snyk’s FAQ lists the other free limits as 200 Open Source tests, 300 IaC tests and 100 Container tests. The Team plan is listed as starting at $25 a month, billed monthly, for teams of up to 10 developers, with 1,000 Snyk Code tests a month and 100 projects. Larger plans use credits through sales.

A practical note: 100 tests a month runs out fast if every push on every branch runs a test. Run Snyk Code on pull requests to main and on a schedule, not on every commit. The snyk/actions README examples reference @master; pin to a release tag or commit SHA if you use them.

Bearer CLI

Bearer CLI is a SAST tool with a privacy angle. Its built-in rules cover the OWASP Top 10 and CWE Top 25, and it detects sensitive data flows, which is useful when you need to show where personal data goes. The free CLI supports Go, Java, JavaScript, TypeScript, PHP, Python and Ruby. Cross-file analysis and further languages are in the commercial Bearer Pro through Cycode.

bearer scan .

Check the licence before adopting it: the CLI is under the Elastic License 2.0, which is source-available rather than an OSI open source licence. The project is actively maintained, with v2.1.3 released on 28 October 2026.

Comparison

Tool	Free option	Paid entry	Analysis depth when free	PR feedback when free	Best fit
SonarQube Community Build	Self-hosted, unlimited	Server Developer, price on request	No taint analysis	No	Code quality on main
SonarQube Cloud	50k private LOC, 5 members	Team from $34/month	Basic, no Advanced Security	PRs to main only	Quality gate plus security rules
Semgrep CE	Free, no account	n/a	Single function	Yes, via CI	Fast custom rules anywhere
Semgrep AppSec Platform	10 contributors, 10 private repos	$30 per contributor/month for Code	Cross-file with Pro rules	Yes	Small private teams
GitHub CodeQL	Public repos	Code Security $30 per active committer/month	Deep data flow	Yes	GitHub-hosted code
Snyk Code	100 tests/month, 5 projects	Team from $25/month	Full product, test-limited	Yes	Teams already on Snyk
Bearer CLI	Free CLI, ELv2	Bearer Pro via Cycode	No cross-file analysis	Via CI	Privacy and data-flow reporting

False positives: where they come from and how to cut them

Every SAST tool produces noise. The useful question is which kind.

Shallow analysis produces false positives and false negatives. A single-function engine such as Semgrep CE cannot see the sanitiser in another file, so it may flag a safe flow. It also cannot follow a tainted value across files, so it misses real ones. Semgrep’s own docs say CE “may find more false positives”. Cross-file engines (Semgrep Code, CodeQL, SonarQube’s taint analysis) trade speed for fewer of both.

Broad query sets produce volume. CodeQL’s security-extended and SonarQube’s quality rules surface more findings. That is fine on a weekly scheduled scan. On pull requests, start narrow.

Old findings drown new ones. Turning on a scanner against a five-year-old codebase produces hundreds of results nobody will triage. Gate pull requests on new findings only: Semgrep’s --baseline-commit does this on the command line, and pull request checks in SonarQube Cloud and GitHub code scanning report against the change. Fix the backlog in planned batches.

What works in practice:

1. Fail the build on high and critical findings only, and only on new code.
2. When you dismiss a finding, record why in the tool, so the next person does not re-triage it.
3. Write a custom rule for every real bug a human or agent finds. Semgrep rules are the easiest to write.
4. Send everything to one place as SARIF, usually GitHub code scanning, so you are not checking four dashboards.

Recommended setup for a small team

I run pipelines on GitHub Actions, GitLab CI and Jenkins, and the right answer depends more on where your code lives and whether it is public than on which engine is cleverest. For a team of under ten developers:

Public repositories on GitHub. Turn on CodeQL default setup and add Semgrep CE on pull requests. Total cost: nothing.

Private repositories on GitHub, under 10 contributors. Use the Semgrep AppSec Platform Free tier as the pull request gate: cross-file analysis at $0, within its 10 private repository limit. Add SonarQube Cloud Free if you also want a code quality gate and you are under 50k lines. Pay for GitHub Code Security when you outgrow that, or if Copilot Autofix and dependency review on private repositories are worth $30 per committer to you. For eight committers, that is $240 a month at list price.

GitLab or Jenkins. Semgrep CE runs anywhere a container runs, and SonarQube scanners exist for both. Snyk’s CLI works the same in any runner. My notes on those platforms are in CI/CD tools compared.

Whatever you pick, SAST is one layer. Pair it with dependency scanning, secret scanning on every push, and an occasional agent-led review for the logic bugs no rule will catch.

Verdict by tool

• SonarQube: Community Build is a code quality tool on one branch, with no PR analysis or taint analysis. Cloud Free covers 50k private lines with main-branch PRs only.
• Semgrep: CE is free, fast and single-function. The AppSec Platform Free tier gives 10 contributors cross-file analysis at $0.
• CodeQL: deepest analysis here, free on public repos, $30 per active committer a month for private repos via GitHub Code Security. Move workflows to v4 before December 2026.
• Snyk Code: capable, but the 100 tests a month free limit suits small or occasional use.
• Bearer: worth a look for privacy data-flow reporting. Check the ELv2 licence first.
• Gate on new high and critical findings, send SARIF to one place, and turn real bugs into custom rules.