cid 4437d0de7306bc0ca4094a88c8fb342d9ec672e64cb8be0e3387bddaec8b61e6 · original · via openalex
Title: Comparative evaluation of static analysis of program code using CodeQL, Semgrep and SonarQube Authors: Mariam A. Borlakova; Sergey Yu. Sitnikov; Vladislav E. Vilkov Venue: SOFT MEASUREMENTS AND COMPUTING Year: 2026 Canonical: doi:10.36871/2618-9976.2026.08.002 URL: https://doi.org/10.36871/2618-9976.2026.08.002 Collector: openalex OA: false ABSTRACT This article provides a comparative evaluation of the static code analysis tools CodeQL, Semgrep, and SonarQube. The architectural principles, data flow analysis mechanisms, and propagation of potentially dangerous values, as well as the effectiveness of defect detection, are compared. Accuracy, recall, harmonic measure, false positive rate, and computational effort are used for quantitative evaluation. The advantages and limitations of each tool are identified, areas of rational application are defined, and the feasibility of combined analysis for ensuring software quality and security is substantiated.