gosec

CodeQL

github/codeql

Popular

GitHub's semantic code analysis engine behind code scanning and Copilot Autofix; free for public repos.

Semgrep

semgrep/semgrep

Popular

Fast, pattern-based multi-language static analysis with community and pro rules; popular in CI.

SonarQube

SonarSource/sonarqube

Popular

Code quality and security platform with quality gates on coverage, bugs, smells and vulnerabilities.

Opengrep

opengrep/opengrep

New

Community fork of the Semgrep engine, created after Semgrep moved key features out of its open-source edition.

Checkmarx

checkmarx.com

Enterprise application security platform (Checkmarx One) covering SAST, SCA, DAST, IaC and API security.

Bandit

PyCQA/bandit

Finds common security issues in Python code by walking the AST; a staple Python CI check.

Brakeman

presidentbeef/brakeman

Static analysis security scanner built specifically for Ruby on Rails applications.

eslint-plugin-security

eslint-community/eslint-plugin-security

ESLint rules that flag risky Node.js patterns such as eval, unsafe regex and non-literal fs paths.