AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

3 tools match

Active Perl Clear all

  • Checkmarx

    Checkmarx

    SAST

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial
    Established

  • Graudit

    Wireghoul

    SAST

    A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.

    Open source
    Established

  • HCL AppScan

    HCLSoftware

    SAST

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial
    Established

  • Checkmarx

    Checkmarx

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial Established
    SAST

  • Graudit

    Wireghoul

    A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.

    Open source Established
    SAST

  • HCL AppScan

    HCLSoftware

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial Established
    SAST
Tick up to 4 tools above.