18.2
MobSF is a mobile application security research platform for penetration testing, malware analysis and privacy analysis.
Free planOpen sourceWebAPILinux
Alternatives to Semgrep Code
Semgrep Code helps development teams find and fix vulnerabilities in source code. Its multimodal detection combines deterministic checks for issues such as cross-site scripting and SQL injection with AI analysis of harder flaws, including IDOR and business logic vulnerabilities. It supports 35 programming languages, scans pull requests, offers IDE and CI integrations, and puts tailored remediation steps in pull requests. The Free Edition includes Code and Supply Chain for up…
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.2
Bandit is a free security linter for Python source code.
Free planOpen sourceExtensionLinuxmacOS
- 4
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
NaiveSystems Analyze
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 6
Kiuwan Code Security
Kiuwan Code Security is a static application security testing tool that finds and prioritizes vulnerabilities in source code and offers remediation…
WebAPILinuxmacOS6.8From $49 a month - 7
ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
WebAPILinuxmacOS6.5From $1,000 a month - 8
NodeJsScan
NodeJsScan is a free, open-source static application security testing scanner for Node.js application source code.
Free planWebAPILinuxmacOS6.4Free plan - 9
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 10
Qwiet AI
Qwiet AI is part of the Harness platform and scans source code and dependencies for application security vulnerabilities.
WebAPIExtensionLinux6.3 - 11
Joern
Joern analyzes source code, bytecode, and binary code to support vulnerability discovery and static program analysis research.
APILinuxmacOSSelf-hosted6.2 - 12
Fluid Attacks
Fluid Attacks is an application security platform for finding, reporting, managing and remediating vulnerabilities across the software development lifecycle.
WebAPILinuxmacOS6.1 - 13
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 14
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 15
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 16
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 17
Security Code Scan
Security Code Scan is a free, open-source static analyzer for .NET code written in C# and VB.NET.
Free planLinuxSelf-hostedWindows6.0Free plan - 18
Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
WebLinuxmacOSSelf-hosted5.9 - 19
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 20
DerScanner
WebAPILinuxSelf-hosted5.6 - 21
OpenText Fortify SAST
WebLinuxmacOSWindows5.3 - 22
Klocwork
WebLinuxWindows5.2 - 23
Snyk Code
Web5.0 - 245.0
- 25
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9