AppSecNews

Top 10
Articles
About
Contact

Browse by category

SAST31 Static Application Security Testing
SCA28 Software Composition Analysis
DAST34 Dynamic Application Security Testing
IAST6 Interactive Application Security Testing
RASP9 Runtime Application Self-Protection
AI Security45 AI and LLM Security
API Security9 API Security
IaC Security17 Infrastructure as Code Security
ASPM16 Application Security Posture Management
Mobile Security23 Mobile Application Security
Container Security8 Container and Image Security
Secret Scanning9 Secret Detection and Scanning
WAF1 Web Application Firewall

Start here

All categories
Top 10 lists by category
Buyer guides and comparisons

Counts are published profiles. Every listing follows the same editorial standard; none are paid for.

Top 10
Articles
About
Contact

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

Filters

License

Open source 2 Open source and commercial 0 Commercial 0 Commercial, free tier 0 Freemium 0 Free 0

Subcategory

Taint analysis 1 Code Quality 0 Enterprise Sast 0 Static Analysis 1 Compliance Reporting 0 Pattern matching 0 Analyzer Orchestration 0 Ast Pattern Matching 0 Ci Cd Scanning 0 Cli Scanner 0 Compliance Standards 0 Custom Rules 0 Embedded C Cpp 0 Php Analysis 2 Pull Request Gating 0 Quality Gates 0 Type Inference 2 Abstract Interpretation 0 Ai Assisted Analysis 0 Apex Security 0 Appsec Platform 0 Appsec Suite 0 Autofix 0 Automated Remediation 0 Binary Analysis 0 Bug Patterns 0 Build Integrated Analysis 0 Business Logic Flaws 0 Bytecode Analysis 0 Code Health 0 Code Quality Metrics 0 Community Fork 0 Concurrency Analysis 0 Connected Mode 0 Copy Paste Detection 0 Data Flow Analysis 0 Developer Feedback 0 Developer Tooling 1 Exploit Generation 0 Formal Methods 0 Framework Aware Scanning 0 Go Analysis 0 Grep Based Scanning 0 Hybrid Analysis 0 Ide Inspections 0 Ide Plugin 0 Intelligent Finding Analytics 0 Interprocedural Analysis 0 Interprocedural Dataflow 0 Java Analysis 0 Javascript Analysis 0 Linter Aggregation 0 Manual Code Review 0 Memory Safety 0 Merge Request Gating 0 Multi Language Analysis 0 Multi Language Scanning 0 Nodejs Security 0 On The Fly Analysis 0 Pipeline Native Scanning 0 Pipeline Scanning 0 Plugin Ecosystem 0 Policy Management 0 Privacy Risk 0 Python Analysis 0 Query Based Analysis 0 Ruby On Rails 0 Rule Based Analysis 0 Rule Levels 1 Safety Critical Code 0 Secret Detection 0 Security Hotspots 0 Self Hosted Ui 0 Sensitive Data Discovery 0 Signature Databases 0 Test Automation 0 Variant Analysis 0

Deployment

CI/CD 2 CLI 2 Self hosted 0 IDE plugin 0 SaaS 0 Library 2 Desktop 0 Kubernetes 0

Languages

Java 0 JavaScript 0 PHP 2 Python 0 Go 0 Ruby 0 C++ 0 Kotlin 0 TypeScript 0 Swift 0 Scala 0 Csharp 0 Cpp 0 c# 0 c++ 0 Apex 0 Objective-C 0 Rust 0 Cobol 0 Perl 0 Terraform 0 Vb 0 Abap 0 Pl Sql 0 Sql 0 T Sql 0 Android 0 Dart 0 Docker 0 Dotnet 0 Elixir 0 Erlang 0 Fortran 0 Groovy 0 Hcl 0 Jsp 0 Plsql 0 Rpg 0 Shell 0 Xml 0

Integrations

GitHub Actions 2 Gitlab Ci 2 Jenkins 0 Jira 0 Azure DevOps 0 Eclipse 0 Visual Studio 0 Intellij Idea 0 Sarif 0 SonarQube 0 Bitbucket 0 Intellij 0 GitHub 0 GitLab 0 Gradle 0 Maven 0 Slack 0 Composer 2 Docker 0 Vs Code 0 Vscode 0 Ant 0 Buck 0 CircleCI 0 Cmake 0 Github Advanced Security 0 Golangci Lint 0 Make 0 Phpstorm 1 Pre Commit 0 Sonarcloud 0 Teamcity 0 Xcodebuild 0

Maturity

Established 2 Growing 0 Emerging 0

Signals Verified profile 0 Has endorsements 0

Clear

2 tools match

Sort

Active Type Inference Clear all

PHPStan

PHPStan project (Ondrej Mirtes and contributors)

SAST

Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

Open source

Established Compare PHPStan
Psalm

Psalm project (originated at Vimeo)

SAST

Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

Open source

Established Compare Psalm

PHPStan

PHPStan project (Ondrej Mirtes and contributors)

Static analyzer for PHP that infers types and reports code that cannot work, configurable through escalating strictness levels.

Open source Established

SAST Compare PHPStan
Psalm

Psalm project (originated at Vimeo)

Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

Open source Established

SAST Compare Psalm

Tick up to 4 tools above.

Pick at least one more

Other categories

← Web Application Firewall Software Composition Analysis →

SCA
DAST
IAST
RASP
AI Security
API Security
IaC Security
ASPM
Mobile Security
Container Security
Secret Scanning
WAF

Newsletter

AppSecNews Weekly

New tool profiles, head to head comparisons and guides, in one short email. No tracking pixels, and every issue has a one click unsubscribe. Read past issues

Leave this field empty

Email address

Email me the newsletter. One click in any issue unsubscribes, and the address is never shared or sold. We send a confirmation link first.

AppSecNews

Independent research on application security tooling, written for the people who have to choose it.

editorial policy

Every profile follows one published standard: no pricing, no version claims, no invented ratings, and a limitations section for every tool. Listings are never paid for. Advertising is labelled and never affects placement. Read the policy

2 tools match

PHPStan

Psalm

PHPStan

Psalm