AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

5 tools match

Active Bitbucket Clear all

  • Checkmarx

    Checkmarx

    SAST

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial
    Established

  • Codacy

    Codacy

    SAST

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial
    Established

  • DeepSource

    DeepSource

    SAST

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier
    Growing

  • Kiuwan Code Security

    Kiuwan (Idera)

    SAST

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial
    Established

  • SonarQube

    Sonar

    SAST

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier
    Established

  • Checkmarx

    Checkmarx

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial Established
    SAST

  • Codacy

    Codacy

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial Established
    SAST

  • DeepSource

    DeepSource

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier Growing
    SAST

  • Kiuwan Code Security

    Kiuwan (Idera)

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial Established
    SAST

  • SonarQube

    Sonar

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier Established
    SAST
Tick up to 4 tools above.