Security scanning
What is SAST?
Static Application Security Testing: analyzing source code for security flaws without running it.
SAST parses your code, usually into an AST or an intermediate representation, and matches it against rules describing insecure patterns: SQL injection, XSS, command injection, unsafe deserialization, weak cryptography and so on. Because it never executes anything, it can run on every commit and reach code paths a test suite never triggers.
That is also its weakness. Without runtime facts, a SAST engine has to reason about what could happen, so it tends to over-report. False-positive rate and whether findings arrive somewhere developers already work decide much of whether a SAST tool gets used. The opposite failure matters as much: a tool tuned to stay quiet can also miss real vulnerabilities, so check what it catches on your code, not only how little noise it makes.
What to look for
- Data flow across files. Following untrusted input across functions and files is what separates an exploitable injection from a string that only looks dangerous. Cross-file analysis costs more time and memory, so ask whether it also runs on pull request scans or only on scheduled full scans.
- Accuracy on your own code. Trial each tool on a repository you know well, ideally an old commit with vulnerabilities you have since fixed, and count both the noise and the known flaws it misses. AI false-positive filtering cuts noise, but check what it sets aside too.
- Depth in your main languages. A long supported-language list helps a codebase that mixes many languages, but says little about how well each is analyzed. Check that the languages and frameworks you ship most have dedicated security rules, and whether the engine reads source directly or needs a working build.
- Rules for your own frameworks. Internal APIs, wrappers and sanitizers need rules no vendor ships, and custom rules are often gated to higher tiers. Pattern and query rules can be tested and behave the same on every run, while natural-language rules for AI review are quicker to write but less predictable.
- Findings where developers already work. Pull request comments, IDE warnings and a check that can fail the merge get flaws fixed before they ship, though that check needs a bypass path for false positives. Combined quality, dependency and security results are simpler to act on, while a specialist engine may go deeper on SAST.
Best 19 SAST tools
Every tool in the directory whose documentation covers this. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The comment under each tool is our summary of what its own documentation describes.
Code Security Platform
AikidoSAST across 13 languages ships on the free plan next to dependency, secrets, IaC and malware scanning. Data-flow analysis runs inside its credit-metered AI Deep Review on Pro, and custom rules are not offered.
AI Coding Agent
ChatGPT / CodexOpenAI's Codex Security agent covers full repositories and can fail CI by severity, while its cloud scans validate findings in isolation before surfacing them. It needs a Pro, Business, Enterprise or Edu plan, and cloud scanning is a research preview.
Code Security Platform
Checkmarx OneFor enterprise AppSec teams, its graph-based SAST needs no compilation, shows source-to-sink attack vectors and supports custom queries written in its Query Editor. Pricing is quote-only, with no published tiers.
AI Coding Agent
Claude CodeAgentic security review on Pro finds injection, SSRF, auth bypass and weak crypto, and verifier agents reproduce findings before they are reported. Scans are nondeterministic, and the managed review check on Team and Enterprise never blocks a merge by itself.
Code Quality Platform
CodacyCode security, code quality and AI review come together in one platform, with SAST from Opengrep, Gosec, SpotBugs and other analyzers plus custom rules and opt-in AI false-positive scoring on the Team plan. It does no taint or data-flow analysis.
PR Review Tool
CodeAnt AIIts Code Security plan, sold separately from AI review, pairs OWASP Top 10 2021 rules across nine categories with dependency, secrets and IaC scanning on all four major Git providers. There is no taint or data-flow analysis behind the rules.
PR Review Tool
CodeRabbitIts AI pull request review runs Semgrep, Opengrep and other analyzers from Pro, with ast-grep custom rules. Tracing untrusted input to sinks needs AI Deep Scan, a separately billed add-on.
Code Security Platform
CorgeaAI-native SAST aimed at business-logic and auth flaws, with cross-file taint tracking and false-positive classification that shows its reasoning, all from the Free tier. It covers 11 languages for SAST, so check yours are on the list.
PR Review Tool
Cursor (Bugbot)Bugbot points out security issues in pull request diffs, and findings open straight in Cursor or in a Cloud Agent that pushes a fix branch. Security Agents, which scan the wider codebase, need a Team or Enterprise plan.
Code Quality Platform
DeepSourceBug-risk and security checks from 18 core analyzers run on every commit and pull request, with Quality Gates that can fail the check and an air-gapped Enterprise option. Custom rules are limited to plugging in third-party SARIF tools.
AI Coding Agent
Gemini Code AssistIts GitHub pull request review, in preview, flags injection, CSRF, IDOR and input-validation issues in changed code, with inline suggestions you can commit directly. There is no merge-blocking check, and new subscriptions go through Google Cloud sales.
Code Security Platform
GitHub Advanced SecurityCodeQL's semantic analysis and taint tracking live inside GitHub pull requests and rulesets, with custom query packs and Copilot Autofix. CodeQL scanning is free on public repositories, private code needs the Code Security add-on, and only GitHub is supported.
PR Review Tool
GreptileOpengrep pattern-matching rules and AI review grounded in the whole repository graph both run on the free Starter plan. Findings, though, are reported per pull request rather than from a full codebase scan.
Code Quality Platform
QltySemgrep, Bandit, Brakeman and PMD run through a free CLI locally, in git hooks and in CI, with custom Semgrep and ast-grep rules. Qlty Cloud, which adds pull request comments and gates, works with GitHub only.
PR Review Tool
QodoMulti-agent pull request review includes compliance checks that look for SQL injection, XSS, CSRF and exposed secrets in each diff. Security analysis stops at these LLM checks on changed code.
Code Security Platform
SemgrepAn open-source engine with taint tracking and YAML rules that resemble the code they match, so rules for in-house frameworks are practical to write. Cross-file analysis needs the Pro Engine on Teams and runs only on full scans.
Code Security Platform
SnykSnyk Code's data-flow analysis draws on AI-learned sources, sinks and sanitizers, and the free plan includes real-time scanning in the IDE. Custom sanitizer rules for Snyk Code need Ignite or Enterprise.
Code Quality Platform
SonarQubeSecurity rules sit alongside code quality across 40+ languages, some Enterprise-only, with free pull request gating and a free self-managed Community Build. Taint tracking is offered too, but check whether it needs Advanced SAST, which is sold separately.
Code Security Platform
VeracodeBuilt for enterprise and regulated programs, it scans compiled or packaged applications, maps findings to CWE and covers legacy languages such as COBOL and RPG. Licensing is quote-only and sold per product.
Related terms
FAQ
What is SAST?
Static Application Security Testing: analyzing source code for security flaws without running it.
How many tools in the directory offer SAST?
19 of the 20 tools in this directory offer SAST:
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The comment under each tool is our summary of what its own documentation describes.
What should you check when comparing tools with SAST?
Five things, each explained under "What to look for" above:
- Data flow across files
- Accuracy on your own code
- Depth in your main languages
- Rules for your own frameworks
- Findings where developers already work