AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

31 tools

  • PT Application Inspector

    Positive Technologies

    SAST

    Static analyzer that combines several analysis techniques and attempts to generate a working exploit for each finding to separate real issues from noise.

    Commercial
    Established

  • Qodana

    JetBrains

    SAST

    Static analysis platform that runs the inspection engine from JetBrains IDEs as a containerized pipeline job with quality gates and trend reporting.

    Commercial, free tier
    Growing

  • Semgrep

    Semgrep, Inc.

    SAST

    Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.

    Open source and commercial
    Established

  • SonarLint

    Sonar

    SAST

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial
    Established

  • PT Application Inspector

    Positive Technologies

    Static analyzer that combines several analysis techniques and attempts to generate a working exploit for each finding to separate real issues from noise.

    Commercial Established
    SAST

  • Qodana

    JetBrains

    Static analysis platform that runs the inspection engine from JetBrains IDEs as a containerized pipeline job with quality gates and trend reporting.

    Commercial, free tier Growing
    SAST

  • Semgrep

    Semgrep, Inc.

    Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.

    Open source and commercial Established
    SAST

  • SonarLint

    Sonar

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial Established
    SAST

  • SonarQube

    Sonar

    SAST

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier
    Established

  • SpotBugs

    SpotBugs project

    SAST

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source
    Established

  • Veracode

    Veracode

    SAST

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial
    Established

  • SonarQube

    Sonar

    Self hosted analysis server that scans repositories for quality and security issues, enforces quality gates and tracks findings over time.

    Commercial, free tier Established
    SAST

  • SpotBugs

    SpotBugs project

    Successor to FindBugs that analyzes compiled JVM bytecode against a catalog of bug patterns, extensible with security focused detector plugins.

    Open source Established
    SAST

  • Veracode

    Veracode

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial Established
    SAST
Tick up to 4 tools above.