Originally reported by devclass.com. Original announcement date: September 2019.
Microsoft Buys Semmle to Deepen GitHub Security Capabilities
Microsoft, via GitHub, acquired code analysis firm Semmle in September 2019 in a move designed to bring structured, query-driven vulnerability detection directly into the software development workflow. The acquisition represented a significant step in GitHub’s broader push to make security an integrated part of the developer experience rather than a downstream afterthought.
What Semmle Built
At the time of acquisition, Semmle offered two primary products:
- QL (now CodeQL): A semantic code analysis engine aimed at product security teams. QL allowed security researchers to write declarative queries that identify specific code patterns across large codebases, making it practical to find zero-day vulnerabilities and detect variants of known issues at scale.
- LGTM: A developer-facing platform (the name is shorthand for “Looks Good To Me”) that ran automated analysis on pull requests and commits to catch vulnerabilities before they reached production. LGTM.com was free for public and open source repositories.
The core idea behind Semmle’s technology is treating code as data. Instead of writing bespoke scanners per vulnerability class, security engineers write queries in QL — a logic-based language — and run them against a queryable representation of a codebase. Queries can be shared across teams and projects, allowing the security community to build a reusable library of vulnerability detectors.
Why GitHub Made the Move
In a blog post at the time of acquisition, GitHub CEO Nat Friedman described Semmle’s engine as allowing developers to “write queries that identify code patterns in large codebases and search for vulnerabilities and their variants.” The community aspect was central to the pitch: researchers share queries, improving coverage across many codebases simultaneously.
GitHub product SVP Shanku Niyogi framed the problem more bluntly: the security lifecycle was broken. Vulnerability identification was largely manual and ad hoc. Disclosures were often irresponsible or absent. Fixes frequently happened outside standard open source workflows, developers often received no alerts, and “updating vulnerable dependencies takes too long or simply doesn’t happen at all.”
The vision Niyogi articulated was for vulnerability management to follow the same structured, collaborative workflow that the pull request created for code contributions. Rather than security being a parallel, disconnected process, it would become a first-class citizen of the development lifecycle on GitHub.
GitHub as a CVE Numbering Authority
Alongside the Semmle acquisition announcement, GitHub disclosed that it had been approved as a CVE Numbering Authority (CNA) for open source projects. This meant GitHub could issue CVE identifiers directly for security advisories opened on the platform, enabling faster, broader disclosure across the industry without requiring project maintainers to coordinate with a separate authority.
Semmle founder Oege de Moor noted that full adoption of the combined vision would mean every CVE eventually coming with a corresponding Semmle query — a machine-readable, executable description of the vulnerability that any project could run against its own code.
Impact on Existing Users
De Moor pledged no disruption to existing Semmle customers. LGTM.com was committed to remaining free for public repositories and open source projects, and Semmle’s open source research program was to continue. The products were eventually folded into what GitHub now calls CodeQL, the analysis engine underpinning GitHub Advanced Security.
Context: The GitHub vs. GitLab Security Race
The Semmle acquisition was part of an accelerating competition between GitHub and GitLab on security features. In the months leading up to the deal, GitHub had already acquired Dependabot (automated dependency update pull requests) and added token scanning, maintainer security advisories, and automated security fixes. GitLab, for its part, had acquired dependency scanning firm Gemnasium in 2018.
The timing was notable: GitHub’s Semmle announcement came the day after GitLab disclosed a $268 million funding round, a portion of which was earmarked for expanding its own security capabilities.
What This Means for DevOps Teams
For engineering teams running their code on GitHub, the practical implications of the Semmle acquisition play out in a few ways:
- Automated vulnerability scanning in CI: CodeQL (the successor to QL and LGTM) can be added to GitHub Actions workflows to scan code on every push or pull request.
- Community-maintained query libraries: The CodeQL query libraries are open source, meaning vulnerability patterns discovered by the security community are continuously added and available to all users.
- Standardised disclosure: With GitHub as a CNA, maintainers can open a security advisory, coordinate privately with reporters, and publish a CVE without leaving the platform.
- Shift-left security posture: By surfacing vulnerability findings as pull request annotations, developers receive security feedback at the same point in the workflow where they receive code review feedback.
The acquisition marked a clear statement of intent: GitHub was positioning itself not just as a code hosting platform but as a security layer for the software supply chain.