General issue: Can I use CodeQL for work?

[kajogo777]

Description of the issue

Just discovered this project and I am really fond of the idea!

I want to spend more time exploring what I could do using CodeQL and apply it to real scenarios in my full-time job as a security engineer, I understand this code is licensed under MIT, but the main website says "CodeQL is free for research and open source."

so am I allowed to use this in my work? did I get something wrong?

Update
which license applies to codeql, MIT or this?
https://securitylab.github.com/tools/codeql/license

[xsser]

I guess you can use codeQL rules in your work, but cli not.
Especially CI\CD

[swordgardctf]

I was wondering if anybody else has insight on this? @sj ?

[emilva]

The MIT license and the terms given on that page is confusing. What if I fork this repo and build my own cli? I guess it can be used commercially then according to MIT?

[intrigus-lgtm]

The codeql queries are licensed under MIT.
The codeql-cli is not open source and licensed under a custom license.

[emilva]

Thanks @intrigus-lgtm that makes sense. This repo is only for queries, and the code for the CLI lives elsewhere and under another license.

[sj]

That is indeed correct! So:

• All CodeQL queries and libraries in the github/codeql repo are MIT-licensed
• The usage of the CLI (which isn't open source itself) is governed by https://securitylab.github.com/tools/codeql/license. tl;dr below.
• The Visual Studio Code extension for writing and running CodeQL queries is open source under MIT (https://github.com/github/vscode-codeql), and uses the CLI

tl;dr on CodeQL CLI license

Here's what you may do with the Software, but subject to License Restrictions provisions below:

• Use the Software to perform academic research.
• Use the Software to demonstrate the Software.
• Test CodeQL queries that are released under an OSI-approved Licence to confirm that new versions of those queries continue to find the right vulnerabilities.

Things you can do only on Open Source Codebase and subject to the License Restrictions provisions below:

• Perform analysis on the Open Source Codebase.
• If the Open Source Codebase is hosted and maintained on GitHub.com, generate CodeQL databases for or during automated analysis, CI, or CD.

[...]

Quoted from: https://securitylab.github.com/tools/codeql/license

[kajogo777]

Thank you for clarifying this

[xsser]

obviously George <notifications@github.com>于2021年1月2日 周六18:43写道：

Closed #4025 <#4025>. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#4025 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOD3E4BLHVOFLVQKM3DHXDSX32FHANCNFSM4PXAG32Q> .

-- I'v got you email ;)