AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

31 tools

  • Bandit

    PyCQA

    SAST

    An AST-based security linter for Python that flags common insecure patterns such as unsafe deserialization, shell injection and weak crypto.

    Open source
    Established Verified

  • Bearer

    Bearer (Cycode)

    SAST

    A static analyzer that classifies sensitive data in code and reports where it flows, joining security findings to privacy and compliance concerns.

    Open source
    Growing

  • Brakeman

    Brakeman

    SAST

    A Rails-aware static analyzer that models controllers, routes and views to find injection, mass assignment and unsafe redirect flaws in Ruby code.

    Commercial, free tier
    Established

  • Checkmarx

    Checkmarx

    SAST

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial
    Established

  • Codacy

    Codacy

    SAST

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial
    Established

  • Corgea

    Corgea

    SAST

    An AI-centric code security product that reviews source with large language models to find flaws and propose patches developers can apply directly.

    Commercial
    Emerging

  • Coverity

    Black Duck

    SAST

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial
    Established

  • DeepSource

    DeepSource

    SAST

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier
    Growing

  • GitHub CodeQL

    GitHub

    SAST

    A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.

    Open source and commercial
    Established

  • GitLab SAST

    GitLab

    SAST

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source
    Established

  • gosec

    Go Security (securego)

    SAST

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source
    Established Verified

  • Graudit

    Wireghoul

    SAST

    A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.

    Open source
    Established

  • Bandit

    PyCQA

    An AST-based security linter for Python that flags common insecure patterns such as unsafe deserialization, shell injection and weak crypto.

    Open source Established
    SAST

  • Bearer

    Bearer (Cycode)

    A static analyzer that classifies sensitive data in code and reports where it flows, joining security findings to privacy and compliance concerns.

    Open source Growing
    SAST

  • Brakeman

    Brakeman

    A Rails-aware static analyzer that models controllers, routes and views to find injection, mass assignment and unsafe redirect flaws in Ruby code.

    Commercial, free tier Established
    SAST

  • Checkmarx

    Checkmarx

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial Established
    SAST

  • Codacy

    Codacy

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial Established
    SAST

  • Corgea

    Corgea

    An AI-centric code security product that reviews source with large language models to find flaws and propose patches developers can apply directly.

    Commercial Emerging
    SAST

  • Coverity

    Black Duck

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial Established
    SAST

  • DeepSource

    DeepSource

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier Growing
    SAST

  • GitHub CodeQL

    GitHub

    A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.

    Open source and commercial Established
    SAST

  • GitLab SAST

    GitLab

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source Established
    SAST

  • gosec

    Go Security (securego)

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source Established
    SAST

  • Graudit

    Wireghoul

    A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.

    Open source Established
    SAST

  • HCL AppScan

    HCLSoftware

    SAST

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial
    Established

  • Horusec

    Zup Innovation

    SAST

    An open-source CLI that orchestrates a set of language-specific security scanners in containers and merges their findings into one report.

    Open source
    Established

  • Infer

    Meta

    SAST

    A static analyzer built on separation logic that proves properties about memory and concurrency, catching null dereferences, leaks and data races.

    Open source
    Established

  • Kiuwan Code Security

    Kiuwan (Idera)

    SAST

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial
    Established

  • Klocwork

    Perforce Software

    SAST

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial
    Established

  • NodeJSScan

    Ajin Abraham

    SAST

    Static security scanner for Node.js applications with a self hosted web interface, built on a pattern matching rule engine for JavaScript.

    Open source
    Growing

  • OpenGrep

    Opengrep community project

    SAST

    Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.

    Open source
    Emerging

  • OpenText Fortify

    OpenText

    SAST

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial
    Established

  • Parasoft

    Parasoft

    SAST

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial
    Established

  • PHPStan

    PHPStan project (Ondrej Mirtes and contributors)

    SAST

    Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

    Open source
    Established

  • PMD

    PMD open source project

    SAST

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source
    Established

  • Psalm

    Psalm project (originated at Vimeo)

    SAST

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source
    Established

  • HCL AppScan

    HCLSoftware

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial Established
    SAST

  • Horusec

    Zup Innovation

    An open-source CLI that orchestrates a set of language-specific security scanners in containers and merges their findings into one report.

    Open source Established
    SAST

  • Infer

    Meta

    A static analyzer built on separation logic that proves properties about memory and concurrency, catching null dereferences, leaks and data races.

    Open source Established
    SAST

  • Kiuwan Code Security

    Kiuwan (Idera)

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial Established
    SAST

  • Klocwork

    Perforce Software

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial Established
    SAST

  • NodeJSScan

    Ajin Abraham

    Static security scanner for Node.js applications with a self hosted web interface, built on a pattern matching rule engine for JavaScript.

    Open source Growing
    SAST

  • OpenGrep

    Opengrep community project

    Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.

    Open source Emerging
    SAST

  • OpenText Fortify

    OpenText

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial Established
    SAST

  • Parasoft

    Parasoft

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial Established
    SAST

  • PHPStan

    PHPStan project (Ondrej Mirtes and contributors)

    Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

    Open source Established
    SAST

  • PMD

    PMD open source project

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source Established
    SAST

  • Psalm

    Psalm project (originated at Vimeo)

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source Established
    SAST
Tick up to 4 tools above.