CodeQL: Extracting a Codebase into a Database and Querying Data Flow
CodeQL builds a code database with language extractors, then queries syntax, types, calls, control flow, and data flow; its depth depends on models and carries extraction and query-maintenance costs.