18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Skylos
Skylos combines static analysis for security regressions, secrets, dead code, quality issues, and AI-introduced mistakes. Its CLI runs locally without an account and supports CI checks, while a free VS Code extension offers inline diagnostics and optional AI verification. It covers a broad set of languages and deployment configuration, though analysis depth varies. Cloud features include GitHub pull request workflows, OIDC identity, and optional Slack or Discord…
27.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
37.3
OpenGrep is an open-source static analysis engine for searching source code patterns and identifying security issues.
Free planOpen sourceAPILinuxmacOS
- 4
Bandit
Bandit is a free security linter for Python source code.
Free planOpen sourceExtensionLinuxmacOSSelf-hosted7.2Free plan - 5
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 6
Puma Scan
Puma Scan is a static application security testing tool for C# development in Visual Studio.
Free planLinuxmacOSSelf-hostedWindows6.8From $299 a year - 7
MobSF
MobSF is an open-source framework for checking mobile apps for security issues through static and dynamic analysis.
Free planAndroidiOSWebAPI6.7Free plan - 8
Pysa
Pysa is a Python static analysis tool that uses taint analysis to identify potential security issues in source code.
Free planExtensionLinuxmacOSSelf-hosted6.7Free plan - 9
Horusec
Horusec is a static code analysis tool for finding security flaws during software development.
Free planWebAPIExtensionLinux6.6Free plan - 10
Microsoft DevSkim
Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis.
Free planAPIExtensionLinuxmacOS6.4Free plan - 11
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 12
Mend SAST
Mend SAST is a source-code security tool for finding vulnerabilities in code written by people or AI assistants and managing them in developer workflows.
WebLinuxmacOSSelf-hosted6.3From $1,000 a year - 13
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 14
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 15
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 16
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 17
Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
WebLinuxmacOSSelf-hosted5.9 - 18
Dawnscanner
Dawnscanner is a free, MIT-licensed static analysis security scanner for Ruby web applications.
Free planLinuxSelf-hosted5.8Free plan - 19
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 20
Klocwork
WebLinuxWindows5.2 - 21
Snyk Code
Web5.0 - 225.0
- 23
Checkmarx SAST
WebLinuxWindows4.9 - 24
njsscan
LinuxmacOS4.6