18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Bandit
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.1
MobSF is a mobile application security research platform for penetration testing, malware analysis and privacy analysis.
Free planWebAPILinux
- 4
Horusec
Horusec is a static code analysis tool for finding security flaws during software development.
Free planWebAPIExtensionLinux6.6Free plan - 5
Xygeni
Xygeni is an application security platform for risks across the software supply chain.
Free planWebAPIExtensionLinux6.6Free plan - 6
NodeJsScan
NodeJsScan is a free, open-source static application security testing scanner for Node.js application source code.
Free planWebAPILinuxmacOS6.4Free plan - 7
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 8
Mend SAST
Mend SAST is a source-code security tool for finding vulnerabilities in code written by people or AI assistants and managing them in developer workflows.
WebLinuxmacOSSelf-hosted6.3From $1,000 a year - 9
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planLinuxmacOSSelf-hosted6.2Free plan - 10
Joern
Joern analyzes source code, bytecode, and binary code to support vulnerability discovery and static program analysis research.
APILinuxmacOSSelf-hosted6.2 - 11
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 12
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 13
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 14
GitHub Secret Scanning
GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited.
WebAPISelf-hosted5.9From $19 a month - 15
OpenText Fortify SAST
WebLinuxmacOSWindows5.3 - 16
Klocwork
WebLinuxWindows5.2 - 17
Snyk Code
Web5.0 - 185.0
- 19
Checkmarx SAST
WebLinuxWindows4.9 - 20
Find Security Bugs
LinuxmacOSWindows4.7 - 21
SecuSAST
LinuxmacOSWindows4.7 - 22
CodeThreat
Web4.6 - 234.3