We're a small team. Need to move fast. Need to actually fix things, not just generate noise.
Evaluating Semgrep vs CodeQL for our Python monorepo. Vendor pages are useless. Need real trade-offs.
My take so far:
**Semgrep**
* Pros: Fast scans. Rules are simple YAML, can write in an afternoon. Decent for security *and* code quality.
* Cons: Less deep than CodeQL. Pattern-matching has limits for complex data flow.
**CodeQL**
* Pros: Finds complex vulns others miss. Real data flow analysis.
* Cons: Steeper learning curve. Slower. Needs a compiled database, not just `git push`.
Example: finding a Flask route with no auth.
Semgrep rule is straightforward:
```yaml
rules:
- id: flask-unauthenticated-route
patterns:
- pattern: "@app.route(...)"
- pattern-not: "...login_required..."
message: Route without authentication decorator.
languages: [python]
severity: WARNING
```
CodeQL needs a proper query, but catches indirect cases.
For a 10-person shop, is CodeQL's power worth the operational overhead? Or is Semgrep's speed and simplicity the better ROI?
I'm a devops lead at a 30-person fintech SaaS, same Python/Flask monorepo setup, and we've been running both Semgrep SAST and CodeQL scanning in CI for about 18 months.
**Real pricing:** Semgrep's Team tier was ~$4.5/seat/month when we signed for 15 devs, CodeQL is free. Hidden cost for CodeQL is engineering time to learn and maintain queries. Our rule tuning for Semgrep took a senior dev about 3 days to reduce noise.
**CI integration & speed:** Semgrep installs and runs in under 2 minutes on our average PR. CodeQL's "autobuild" step plus query takes 12-15 minutes on cold cache. We had to move CodeQL to nightly scans only because of this.
**Finding quality and noise:** For straightforward bug patterns (like missing auth decorators, hardcoded secrets), Semgrep's precision was 90%+. CodeQL flagged 4 critical data-flow vulns in our 3rd-party library usage that Semgrep missed, but its initial output had a 60% false positive rate for our codebase.
**Operational lift:** Writing a new Semgrep rule takes a dev 2-3 hours max. Getting a useful, custom CodeQL query for a new pattern took us nearly a sprint of back-and-forth learning.
I'd pick Semgrep for your team's main CI blocker. It gets you from zero to fixing real issues in a week. Keep a free CodeQL nightly scan as a secondary deep check. To make a cleaner call, tell us what percentage of your security budget is tooling versus dedicated engineering time, and if you have any compliance drivers like SOC2 that require specific coverage.
Help me decide