Static Code Analysis

Semgrep

Static analysis at ludicrous speed.

A fast, open-source, and customizable static analysis tool for finding bugs, enforcing code standards, and securing code.

View tool details →

PVS-Studio

A static code analyzer for bug detection in C, C++, C#, and Java source code.

A static analysis tool for developers, specializing in finding errors and potential vulnerabilities in C, C++, C#, and Java code.

View tool details →

CodeQL

The world’s most powerful code analysis engine.

A semantic code analysis engine that lets you query code as if it were data. Part of GitHub Advanced Security.

View tool details →

DeepSource

Fast and reliable static analysis for developers.

An automated static analysis tool that helps developers find and fix issues in code during code reviews, before they make it to production.

View tool details →

Snyk Code

Developer-first security.

A Static Application Security Testing (SAST) tool that scans and fixes vulnerabilities in your source code in real-time.

View tool details →

ESLint

Find and fix problems in your JavaScript code.

An open-source, pluggable linting utility for JavaScript and JSX, used to identify and report on patterns found in ECMAScript/JavaScript code.

View tool details →

SonarQube

Continuously inspect and secure your code.

An open-source platform for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities.

View tool details →

Parasoft C/C++test

Automated Software Testing for C and C++.

A unified C/C++ testing solution that includes static analysis, unit testing, code coverage, and more for embedded systems.

View tool details →

Veracode Static Analysis

Secure your code from the start.

A cloud-based SAST solution that analyzes compiled code (binaries) to find security flaws with very low false positives.

View tool details →

Codacy

Automated code reviews for your whole team.

An automated code review tool that helps developers ship better software, faster by analyzing code quality, security, and style.

View tool details →

Code Climate Quality

Actionable insights for your code.

A platform that provides automated code review, tracking technical debt, test coverage, and style issues for development teams.

View tool details →

Checkmarx SAST

The Enterprise SAST Leader.

An enterprise-grade static analysis tool that identifies security vulnerabilities in custom code early in the development lifecycle.

View tool details →

Coverity

Industry-leading static analysis.

An enterprise-grade SAST tool from Synopsys known for its high accuracy and ability to find critical defects in complex codebases.

View tool details →

Fortify Static Code Analyzer

Find and fix security vulnerabilities from the start.

A comprehensive SAST solution by OpenText (formerly Micro Focus) for identifying, triaging, and fixing security vulnerabilities in source code.

View tool details →

PMD

A source code analyzer for Java and other languages.

An open-source static source code analyzer that finds common programming flaws like unused variables, empty catch blocks, and unnecessary object creation.

View tool details →

Klocwork

Static Code Analysis & SAST for C, C++, C#, Java, and Python.

A static code analysis and SAST tool from Perforce that specializes in large, complex C, C++, C#, Java, and Python codebases.

View tool details →

Checkstyle

A tool for checking Java source code for adherence to a Code Standard.

An open-source static code analysis tool used to check if Java source code complies with a set of coding rules and standards.

View tool details →

Bandit

A tool designed to find common security issues in Python code.

An open-source tool specifically designed to find common security vulnerabilities in Python code.

View tool details →

Brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications.

An open-source static analysis tool that checks Ruby on Rails applications for security vulnerabilities.

View tool details →

Reshift

Security in your pipeline, without the noise.

A developer-focused SAST tool that aims to reduce false positives and integrate seamlessly into CI/CD pipelines.

View tool details →

Qodana

Code quality platform from JetBrains.

A code quality platform by JetBrains that brings the smart inspections from their IDEs into your CI/CD pipeline.

View tool details →