Best SAST Tools in 2026
Updated
In short: Semgrep Code is ranked #1 of 26 as of 7 October 2026, ahead of Snyk Open Source and Flawfinder. The best-ranked option with a free plan is Snyk Open Source. The lowest first paid tier on this page is Kiuwan Code Security at $4.08/mo.
SAST tools help developers inspect source code for security issues during development. The entries are ranked, with Semgrep Code, Snyk Open Source and PVS-Studio among the first shown. Compare analysis targets and supported languages to understand what each can examine, then consider IDE support, CI/CD integration and pull request scans for how it may fit into a workflow. Automated fixes and custom security rules add further distinctions. Free-plan availability and paid-from pricing give you cost details to weigh alongside those capabilities. The right comparison depends on the code and development process you need to support.
26 SAST tools ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
6 of the 25 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | Semgrep CodeWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Three bars | — | 4 of 6 | $30/mo | 6.7 | |
| 2 | Snyk Open SourceWeb · Windows · Mac · Linux · API | Three bars | — | 4 of 6 | $25/mo | 6.7 | |
| 3 | FlawfinderWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 4 | NaiveSystems AnalyzeWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 5 | BanditMac · Linux · Self-hosted | Two bars | — | 2 of 6 | Free | 6.4 | |
| 6 | gosecMac · Linux · Self-hosted | Two bars | — | 2 of 6 | Free | 6.4 | |
| 7 | Veracode DASTWeb · Windows · Mac · Linux · API | Two bars | — | — | 4 of 6 | — | 5.7 |
| 8 | Black Duck CoverityWeb · Windows · Mac · Linux · Self-hosted | Two bars | — | — | 4 of 6 | — | 5.6 |
| 9 | PVS-StudioWindows · Mac · Linux | Two bars | — | — | 3 of 6 | — | 5.6 |
| 10 | OpenText Fortify SASTWeb · Windows · Mac · Linux | Two bars | — | — | 4 of 6 | — | 5.5 |
| 11 | CodeSonarWeb · Windows · Linux | One bar | — | — | 3 of 6 | — | 5.4 |
| 12 | DerScannerWeb · Windows · Linux | One bar | — | — | 3 of 6 | — | 5.4 |
| 13 | KlocworkWeb · Windows · Linux | Two bars | — | — | 3 of 6 | — | 5.4 |
| 14 | MobSFWeb · Windows · Mac · Linux | One bar | — | — | 4 of 6 | — | 5.4 |
| 15 | BearerMac · Linux | No signal | — | — | 2 of 6 | — | 5.3 |
| 16 | JoernWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 17 | NodeJsScanMac · Linux | No signal | — | — | 2 of 6 | — | 5.3 |
| 18 | Security Code ScanWindows · Linux | No signal | — | — | 2 of 6 | — | 5.3 |
| 19 | Fluid AttacksWeb · Windows · Mac · Linux · API | Two bars | — | — | 4 of 6 | — | 5.2 |
| 20 | Kiuwan Code SecurityWeb · Windows · Mac · Linux · Self-hosted · API | Two bars | — | — | 4 of 6 | $4.08/mo | 5.2 |
| 21 | ZeroPathWeb · Windows · Mac · Linux · Self-hosted · API | Two bars | — | — | 4 of 6 | $1,000/mo | 5.2 |
| 22 | BrakemanNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 23 | Checkmarx API SecurityWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 24 | Checkmarx OneWeb | One bar | — | — | 1 of 6 | — | 4.8 |
| 25 | HCL AppScan SourceWindows · Linux | No signal | — | — | 2 of 6 | — | 4.8 |
Compare all 25 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Analysis targets | Languages supported |
|---|---|---|---|---|---|---|---|---|
| 1 | Semgrep Code | 6.7 | Free plan | $30/mo | Yes | — | source code | 35 |
| 2 | Snyk Open Source | 6.7 | Free plan | $25/mo | Yes | — | source code | 16 |
| 3 | Flawfinder | 6.5 | Free plan | Free | Yes | — | source code | — |
| 4 | NaiveSystems Analyze | 6.5 | Free plan | Free | Yes | — | source code | — |
| 5 | Bandit | 6.4 | Free plan | Free | Yes | — | source code | — |
| 6 | gosec | 6.4 | Free plan | Free | Yes | — | source code | — |
| 7 | Veracode DAST | 5.7 | No | — | — | — | source code, bytecode, binaries | — |
| 8 | Black Duck Coverity | 5.6 | No | — | No | — | source code | — |
| 9 | PVS-Studio | 5.6 | No | — | No | — | source code | — |
| 10 | OpenText Fortify SAST | 5.5 | No | — | — | — | source code, bytecode, binaries | — |
| 11 | CodeSonar | 5.4 | No | — | — | — | source code, binaries | — |
| 12 | DerScanner | 5.4 | No | — | — | — | source code, bytecode, binaries | — |
| 13 | Klocwork | 5.4 | No | — | — | — | source code | — |
| 14 | MobSF | 5.4 | No | — | Yes | — | source code, binaries | — |
| 15 | Bearer | 5.3 | No | — | Yes | — | source code | — |
| 16 | Joern | 5.3 | No | — | Yes | — | source code, bytecode, binaries | — |
| 17 | NodeJsScan | 5.3 | No | — | — | — | source code | — |
| 18 | Security Code Scan | 5.3 | No | — | — | — | source code | — |
| 19 | Fluid Attacks | 5.2 | No | — | No | — | source code | 14 |
| 20 | Kiuwan Code Security | 5.2 | No | $4.08/mo | No | 49 /user/mo | source code | — |
| 21 | ZeroPath | 5.2 | No | $1,000/mo | No | 60 /user/mo | source code | — |
| 22 | Brakeman | 5.1 | No | — | — | — | source code | — |
| 23 | Checkmarx API Security | 5.0 | No | — | No | — | source code | — |
| 24 | Checkmarx One | 4.8 | No | — | No | — | source code | — |
| 25 | HCL AppScan Source | 4.8 | No | — | No | — | source code | — |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which SAST tool is ranked first on Freedom251?
Semgrep Code is ranked #1 of 26 with a score of 6.7. Snyk Open Source is second and Flawfinder third.
How many of these have a free plan?
6 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Kiuwan Code Security has the lowest first paid tier we found: $4.08/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation.