Hi everyone. I've been running a comparison between Snyk Code and GitHub Advanced Security's code scanning (with CodeQL) for the past quarter, and wanted to share our team's experience after fully switching over.
Our primary drivers were cost consolidation and the appeal of a native, integrated workflow. The benchmark, however, was the quality of findings. We ran both tools in parallel on our main monorepo for a month. On raw numbers, Snyk initially flagged more issues. But after triage, we found GHAS/CodeQL had a significantly lower false positive rate for the security issues that truly mattered—things like SQL injection, path injection, and hardcoded credentials. Snyk's broader linting-style catches were often good code hygiene, but diluted the critical security signal.
The biggest adjustment was the mindset shift. Snyk feels like a scanner; GHAS feels like a framework. Setting up custom CodeQL queries for our patterns was a game-changer, though it required more upfront investment. The integration into PR checks is seamless, and having the findings live in the same place as the code has improved developer engagement. The downside? The learning curve for tuning is steeper, and you really need to commit to managing the alert lifecycle in the Security tab.
I'm curious if others have made a similar move. How did you handle the transition with your dev teams, especially around tuning out expected noise? And for those who've used both, where do you see each tool's sweet spot now?
— isabel
— isabel
I'm a platform engineering lead at a mid-size fintech (around 300 engineers) managing our supply chain security program. We've run both Snyk Open Source and Snyk Code in production for two years, and we've been piloting GitHub Advanced Security with CodeQL across our 40+ microservices for the past six months.
* **Pricing & TCO:** Snyk's per-developer seat model ($60-100/developer/month) scaled aggressively as we grew. GHAS, bundled into our existing GitHub Enterprise agreement, came out to a flat $4-5/user/month across all engineers, a decisive factor. The hidden cost is engineering time: tuning CodeQL requires dedicated, skilled hours, while Snyk's initial "out-of-the-box" experience is cheaper on time.
* **Signal-to-Noise & Customization:** Our benchmark matched yours. On a representative Java service, Snyk Code flagged ~120 issues, only 18 of which were true security vulnerabilities. CodeQL flagged 35, with 29 being true positives. Snyk's findings included many code quality items. CodeQL's strength is writing custom queries; we built one for our internal credential framework's misuse, catching issues a generic scanner never could.
* **Integration & Workflow:** GHAS's native PR integration is superior. A Snyk finding appears as a third-party check; a CodeQL finding appears as a GitHub alert with direct, in-context code slicing. Developer remediation time dropped because they weren't switching tools. Snyk requires you to manage its CI plugin and portal, adding friction.
* **Language & Ecosystem Support:** Snyk supports a wider range of niche languages and frameworks out of the box (we have some Go and Rust services where it was useful). CodeQL's supported languages are fewer but deeper, with more advanced data flow analysis for its core set (Java, JS/TS, Python, C#). If your stack is primarily CodeQL-supported, it's fine; if not, you'll have coverage gaps.
Given your focus on critical signal quality and integrated workflow, I'd recommend GHAS for teams with a GitHub-centric, mainstream-language stack who can invest in query tuning. If you have a polyglot environment or need a lower-lift, "scan everything" starting point, Snyk might still be the pragmatic choice. To make the call clean, tell us the primary languages in your monorepo and whether you have 1-2 engineers who can dedicate time to learning and customizing CodeQL.
Measure twice, cut once.