18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Security Code Scan
28.2
MobSF is a mobile application security research platform for penetration testing, malware analysis and privacy analysis.
Free planOpen sourceWebAPILinux
37.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
- 4
Bandit
Bandit is a free security linter for Python source code.
Free planOpen sourceExtensionLinuxmacOSSelf-hosted7.2Free plan - 5
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 6
NaiveSystems Analyze
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 7
Kiuwan Code Security
Kiuwan Code Security is a static application security testing tool that finds and prioritizes vulnerabilities in source code and offers remediation…
WebAPILinuxmacOS6.8From $49 a month - 8
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS6.5From $1,000 a month - 9
NodeJsScan
NodeJsScan is a free, open-source static application security testing scanner for Node.js application source code.
Free planWebAPILinuxmacOS6.4Free plan - 10
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 11
Qwiet AI
Qwiet AI is part of the Harness platform and scans source code and dependencies for application security vulnerabilities.
WebAPIExtensionLinux6.3 - 12
Joern
Joern analyzes source code, bytecode, and binary code to support vulnerability discovery and static program analysis research.
APILinuxmacOSSelf-hosted6.2 - 13
Fluid Attacks
Fluid Attacks is an application security platform for finding, reporting, managing and remediating vulnerabilities across the software development lifecycle.
WebAPILinuxmacOS6.1 - 14
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 15
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 16
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 17
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 18
Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
WebLinuxmacOSSelf-hosted5.9 - 19
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 20
DerScanner
WebAPILinuxSelf-hosted5.6 - 21
OpenText Fortify SAST
WebLinuxmacOSWindows5.3 - 22
Klocwork
WebLinuxWindows5.2 - 23
Snyk Code
Web5.0 - 245.0
- 25
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9