SAST
Analyze source code or bytecode for vulnerable patterns without running the application.
31 tools profiled
How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.
Wireghoul
A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.
Semgrep, Inc.
Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.
GitHub
A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.
DeepSource
A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.
Opengrep community project
Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.
Wireghoul
A shell script that runs curated regular expression signature databases over source code to surface potentially dangerous functions for review.
Semgrep, Inc.
Pattern matching static analysis engine whose rules are written as code snippets with metavariables, with an optional commercial platform for triage.
GitHub
A semantic code analysis engine that turns a codebase into a queryable database and finds vulnerabilities with declarative security queries.
DeepSource
A static analysis platform that runs language-specific analyzers on each pull request and offers one-click automated fixes for many issue classes.
Opengrep community project
Community maintained fork of an open source pattern matching static analysis engine, governed to keep the engine and rule format permissively licensed.