18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Xygeni
28.2
MobSF is a mobile application security research platform for penetration testing, malware analysis and privacy analysis.
Free planOpen sourceWebAPILinux
37.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
- 4
gosec
gosec is a free security checker that scans Go source code for potential problems.
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
Horusec
Horusec is a static code analysis tool for finding security flaws during software development.
Free planWebAPIExtensionLinux6.6Free plan - 6
NodeJsScan
NodeJsScan is a free, open-source static application security testing scanner for Node.js application source code.
Free planWebAPILinuxmacOS6.4Free plan - 7
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 8
Mend SAST
Mend SAST is a source-code security tool for finding vulnerabilities in code written by people or AI assistants and managing them in developer workflows.
WebLinuxmacOSSelf-hosted6.3From $1,000 a year - 9
Joern
Joern analyzes source code, bytecode, and binary code to support vulnerability discovery and static program analysis research.
APILinuxmacOSSelf-hosted6.2 - 10
Bearer
Bearer is a free command-line static application security testing tool for scanning source code and tracing data flows for security and privacy risks.
Free planLinuxmacOS6.0Free plan - 11
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application code.
Free planLinuxSelf-hosted6.0Free plan - 12
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 13
GitHub Secret Scanning
GitHub Secret Scanning detects exposed credentials so they can be addressed before they are exploited.
WebAPISelf-hosted5.9From $19 a month - 14
OpenText Fortify SAST
WebLinuxmacOSWindows5.3 - 15
Klocwork
WebLinuxWindows5.2 - 16
Snyk Code
Web5.0 - 175.0
- 18
Checkmarx SAST
WebLinuxWindows4.9 - 19
Find Security Bugs
LinuxmacOSWindows4.7 - 20
SecuSAST
LinuxmacOSWindows4.7 - 21
CodeThreat
Web4.6 - 224.3
- 234.3