CodeQL builds a code database with language extractors, then queries syntax, types, calls, control flow, and data flow; its depth depends on models and carries extraction and query-maintenance costs.
Semgrep lets teams express SAST policy with source-like patterns and taint rules; rule quality depends on positive and negative tests, framework modeling, and exception lifecycle.
Snyk maps code, open-source, container, and IaC findings to projects, remediation paths, and developer workflows; successful adoption depends on baselines, ownership, and executable policy.