AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

6 tools match

Active Sarif Clear all

  • Bearer

    Bearer (Cycode)

    SAST

    A static analyzer that classifies sensitive data in code and reports where it flows, joining security findings to privacy and compliance concerns.

    Open source
    Growing

  • Brakeman

    Brakeman

    SAST

    A Rails-aware static analyzer that models controllers, routes and views to find injection, mass assignment and unsafe redirect flaws in Ruby code.

    Commercial, free tier
    Established

  • GitHub CodeQL

    GitHub

    SAST

    A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.

    Open source and commercial
    Established

  • Bearer

    Bearer (Cycode)

    A static analyzer that classifies sensitive data in code and reports where it flows, joining security findings to privacy and compliance concerns.

    Open source Growing
    SAST

  • Brakeman

    Brakeman

    A Rails-aware static analyzer that models controllers, routes and views to find injection, mass assignment and unsafe redirect flaws in Ruby code.

    Commercial, free tier Established
    SAST

  • GitHub CodeQL

    GitHub

    A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.

    Open source and commercial Established
    SAST

  • GitLab SAST

    GitLab

    SAST

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source
    Established

  • gosec

    Go Security (securego)

    SAST

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source
    Established Verified

  • Infer

    Meta

    SAST

    A static analyzer built on separation logic that proves properties about memory and concurrency, catching null dereferences, leaks and data races.

    Open source
    Established

  • GitLab SAST

    GitLab

    Pipeline-native static analysis for GitLab that runs containerized analyzers per language and reports findings on merge requests.

    Open source Established
    SAST

  • gosec

    Go Security (securego)

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source Established
    SAST

  • Infer

    Meta

    A static analyzer built on separation logic that proves properties about memory and concurrency, catching null dereferences, leaks and data races.

    Open source Established
    SAST
Tick up to 4 tools above.