This open source repository contains demos of Semmle's products: QL and LGTM. Many of the demos are examples of security vulnerabilities that were found by a QL query. These demos contain step-by-step instructions on how to build a QL query that finds the vulnerability.
You can use the interactive query console or the QL for Eclipse plugin.
The demos are licensed under Apache License 2.0 by Semmle.