18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Microsoft DevSkim
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.3
OpenGrep is an open-source static analysis engine for searching source code patterns and identifying security issues.
Free planOpen sourceAPILinuxmacOS
- 4
Bandit
Bandit is a free security linter for Python source code.
Free planOpen sourceExtensionLinuxmacOSSelf-hosted7.2Free plan - 5
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 6
Skylos
Skylos is an open-source static analysis tool for finding security regressions, exposed secrets, dead code, quality issues, and mistakes introduced by AI.
Free planWebAPIExtensionLinux7.0Free plan - 7
Puma Scan
Puma Scan is a static application security testing tool for C# development in Visual Studio.
Free planLinuxmacOSSelf-hostedWindows6.8From $299 a year - 8
MobSF
MobSF is an open-source framework for checking mobile apps for security issues through static and dynamic analysis.
Free planAndroidiOSWebAPI6.7Free plan - 9
Pysa
Pysa is a Python static analysis tool that uses taint analysis to identify potential security issues in source code.
Free planExtensionLinuxmacOSSelf-hosted6.7Free plan - 10
Horusec
Horusec is a static code analysis tool for finding security flaws during software development.
Free planWebAPIExtensionLinux6.6Free plan - 11
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 12
Mend SAST
Mend SAST is a source-code security tool for finding vulnerabilities in code written by people or AI assistants and managing them in developer workflows.
WebLinuxmacOSSelf-hosted6.3From $1,000 a year - 13
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 14
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 15
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 16
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 17
Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
WebLinuxmacOSSelf-hosted5.9 - 18
Dawnscanner
Dawnscanner is a free, MIT-licensed static analysis security scanner for Ruby web applications.
Free planLinuxSelf-hosted5.8Free plan - 19
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 20
Klocwork
WebLinuxWindows5.2 - 21
Snyk Code
Web5.0 - 225.0
- 23
Checkmarx SAST
WebLinuxWindows4.9 - 24
njsscan
LinuxmacOS4.6