18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to MobSF
MobSF combines mobile-app security research with static and dynamic analysis. Its Static Analyzer handles APK, IPA, APPX, and source code; its Dynamic Analyzer supports Android and iOS apps, including interactive instrumented testing and runtime data and network traffic analysis. REST APIs and CLI tools connect it to DevSecOps and CI/CD pipelines, and Docker supports local deployment. The framework is free under GPL-3.0, with paid support packages available. That mobile…
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.2
Bandit is a free security linter for Python source code.
Free planOpen sourceExtensionLinuxmacOS
- 4
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
NaiveSystems Analyze
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 6
Kiuwan Code Security
Kiuwan Code Security is a static application security testing tool that finds and prioritizes vulnerabilities in source code and offers remediation…
WebAPILinuxmacOS6.8From $49 a month - 7
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS6.5From $1,000 a month - 8
NodeJsScan
NodeJsScan is a free, open-source static application security testing scanner for Node.js application source code.
Free planWebAPILinuxmacOS6.4Free plan - 9
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 10
Qwiet AI
Qwiet AI is part of the Harness platform and scans source code and dependencies for application security vulnerabilities.
WebAPIExtensionLinux6.3 - 11
Joern
Joern analyzes source code, bytecode, and binary code to support vulnerability discovery and static program analysis research.
APILinuxmacOSSelf-hosted6.2 - 12
Fluid Attacks
Fluid Attacks is an application security platform for finding, reporting, managing and remediating vulnerabilities across the software development lifecycle.
WebAPILinuxmacOS6.1 - 13
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 14
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 15
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 16
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 17
Security Code Scan
Security Code Scan is a free, open-source static analyzer for .NET code written in C# and VB.NET.
Free planLinuxSelf-hostedWindows6.0Free plan - 18
Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
WebLinuxmacOSSelf-hosted5.9 - 19
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 20
DerScanner
WebAPILinuxSelf-hosted5.6 - 21
OpenText Fortify SAST
WebLinuxmacOSWindows5.3 - 22
Klocwork
WebLinuxWindows5.2 - 23
Snyk Code
Web5.0 - 245.0
- 25
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9