AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

12 tools match

Active Scala Clear all

  • Checkmarx

    Checkmarx

    SAST

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial
    Established

  • Codacy

    Codacy

    SAST

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial
    Established

  • Coverity

    Black Duck

    SAST

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial
    Established

  • DeepSource

    DeepSource

    SAST

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier
    Growing

  • GitLab SAST

    GitLab

    SAST

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source
    Established

  • HCL AppScan

    HCLSoftware

    SAST

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial
    Established

  • Checkmarx

    Checkmarx

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial Established
    SAST

  • Codacy

    Codacy

    A code quality platform that orchestrates open-source linters and security analyzers, normalizes their output, and enforces standards on pull requests.

    Open source and commercial Established
    SAST

  • Coverity

    Black Duck

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial Established
    SAST

  • DeepSource

    DeepSource

    A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.

    Commercial, free tier Growing
    SAST

  • GitLab SAST

    GitLab

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source Established
    SAST

  • HCL AppScan

    HCLSoftware

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial Established
    SAST

  • OpenGrep

    Opengrep community project

    SAST

    Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.

    Open source
    Emerging

  • OpenText Fortify

    OpenText

    SAST

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial
    Established

  • Semgrep

    Semgrep, Inc.

    SAST

    Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.

    Open source and commercial
    Established

  • SonarQube

    Sonar

    SAST

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier
    Established

  • SpotBugs

    SpotBugs project

    SAST

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source
    Established

  • Veracode

    Veracode

    SAST

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial
    Established

  • OpenGrep

    Opengrep community project

    Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.

    Open source Emerging
    SAST

  • OpenText Fortify

    OpenText

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial Established
    SAST

  • Semgrep

    Semgrep, Inc.

    Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.

    Open source and commercial Established
    SAST

  • SonarQube

    Sonar

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier Established
    SAST

  • SpotBugs

    SpotBugs project

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source Established
    SAST

  • Veracode

    Veracode

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial Established
    SAST
Tick up to 4 tools above.