Opengrep

CodeQL

github/codeql

Popular

GitHub's semantic code analysis engine behind code scanning and Copilot Autofix; free for public repos.

Semgrep

semgrep/semgrep

Popular

Fast, pattern-based multi-language static analysis with community and pro rules; popular in CI.

SonarQube

SonarSource/sonarqube

Popular

Code quality and security platform with quality gates on coverage, bugs, smells and vulnerabilities.

Checkmarx

checkmarx.com

Enterprise application security platform (Checkmarx One) covering SAST, SCA, DAST, IaC and API security.

Bandit

PyCQA/bandit

Finds common security issues in Python code by walking the AST; a staple Python CI check.

gosec

securego/gosec

Go security checker that flags issues like SQL injection, weak crypto and hardcoded credentials.

Brakeman

presidentbeef/brakeman

Static analysis security scanner built specifically for Ruby on Rails applications.

eslint-plugin-security

eslint-community/eslint-plugin-security

ESLint rules that flag risky Node.js patterns such as eval, unsafe regex and non-literal fs paths.