AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

6 tools match

Active SonarQube Clear all

  • Bandit

    PyCQA

    SAST

    An AST-based security linter for Python that flags common insecure patterns such as unsafe deserialization, shell injection and weak crypto.

    Open source
    Established Verified

  • gosec

    Go Security (securego)

    SAST

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source
    Established Verified

  • OpenText Fortify

    OpenText

    SAST

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial
    Established

  • Bandit

    PyCQA

    An AST-based security linter for Python that flags common insecure patterns such as unsafe deserialization, shell injection and weak crypto.

    Open source Established
    SAST

  • gosec

    Go Security (securego)

    A Go security scanner that inspects the AST and SSA representation to flag unsafe patterns such as command injection, weak crypto and unhandled errors.

    Open source Established
    SAST

  • OpenText Fortify

    OpenText

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial Established
    SAST

  • PMD

    PMD open source project

    SAST

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source
    Established

  • SonarLint

    Sonar

    SAST

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial
    Established

  • SpotBugs

    SpotBugs project

    SAST

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source
    Established

  • PMD

    PMD open source project

    Extensible source code analyzer that applies rule sets to the syntax tree of several languages, bundled with a cross language copy and paste detector.

    Open source Established
    SAST

  • SonarLint

    Sonar

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial Established
    SAST

  • SpotBugs

    SpotBugs project

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source Established
    SAST
Tick up to 4 tools above.