AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

4 tools match

Active Library Clear all

  • PHPStan

    PHPStan project (Ondrej Mirtes and contributors)

    SAST

    Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

    Open source
    Established

  • PMD

    PMD open source project

    SAST

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source
    Established

  • Psalm

    Psalm project (originated at Vimeo)

    SAST

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source
    Established

  • SpotBugs

    SpotBugs project

    SAST

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source
    Established

  • PHPStan

    PHPStan project (Ondrej Mirtes and contributors)

    Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

    Open source Established
    SAST

  • PMD

    PMD open source project

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source Established
    SAST

  • Psalm

    Psalm project (originated at Vimeo)

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source Established
    SAST

  • SpotBugs

    SpotBugs project

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source Established
    SAST
Tick up to 4 tools above.