Free and open first

Best SAST Tools in 2026

SAST tools help developers inspect source code for security issues during development. The entries are ranked, with Semgrep Code, Snyk Open Source and PVS-Studio among the first shown. Compare analysis targets and supported languages to understand what each can examine, then consider IDE support, CI/CD integration and pull request scans for how it may fit into a workflow. Automated fixes and custom security rules add further distinctions. Free-plan availability and paid-from pricing give you cost details to weigh alongside those capabilities. The right comparison depends on the code and development process you need to support.

26 apps
Research read 23 Sept 2026
How the order is worked out

1

Bandit

Free plan Open source ExtensionLinuxMac+1

Bandit focuses on Python security linting, with options for baselines, formatted output, and integration into development workflows.

9.3 Free plan Visit site
2

gosec

Free plan Open source APILinuxMac+1

gosec offers configurable static security analysis for Go, with several output formats and CI integration options. Teams should review findings because automated detection can flag safe code.

9.0 Free plan Visit site
3

MobSF

Free plan Open source APILinuxMac+3

MobSF covers static and dynamic mobile-app analysis and offers pipeline integration. The free framework is available under GPL-3.0, while paid plans add services such as support and training.

8.8 Free plan Visit site
4

NaiveSystems Analyze

Free plan Open source LinuxMacSelf-hosted+1

Choose NaiveSystems Analyze if your team works with C or C++ and needs static security analysis or coding-standard checks, especially for the listed safety-critical and embedded use cases.

8.8 Free plan Visit site
5

Semgrep Code

Free plan Open source APIExtensionLinux+4

Semgrep Code pairs static analysis with AI analysis and remediation guidance for findings.

8.6 From $15/user/mo Visit site
6

Flawfinder

Free plan LinuxMacSelf-hosted+1

Flawfinder offers risk-ranked checks for C/C++ source with several report formats and a patch-focused option. Treat it as an aid to security review, not a complete vulnerability detector.

7.5 Free plan Visit site
7

Bearer

Free plan LinuxMac

Choose Bearer CLI if you need a free source-code scanner that combines security checks with data-flow and privacy reporting.

7.4 Free plan Visit site
8

GitHub CodeQL

Free plan ExtensionLinuxMac+3

7.4 Free plan · paid from $30/mo Visit site
9

Brakeman

Free plan LinuxSelf-hosted

Brakeman focuses on security analysis for Rails code and offers multiple ways to install, report results, and automate scans.

7.3 Visit site
10

NodeJsScan

Free plan APILinuxMac+2

NodeJsScan provides configurable source scanning with command-line, API, and web-interface options.

7.2 Open source Visit site
11

Joern

Free plan APILinuxMac+2

Choose Joern if you need an open-source platform for graph-based code analysis, customizable queries, or CI security scanners.

7.0 Free plan Visit site
12

PVS-Studio

Free plan LinuxMacWindows

Choose PVS-Studio if your team needs multi-language source analysis, security checks, and integrations with development tools.

6.9 Pricing on request · 7-day trial Visit site
13

Security Code Scan

Free plan LinuxSelf-hostedWindows

Security Code Scan offers configurable static analysis for .NET projects, with options for editor and pipeline workflows.

6.9 Open source Visit site
14

CodeSonar

Free trial LinuxSelf-hostedWeb+1

Choose CodeSonar if you need static analysis across source code and binaries, with support for named security coverage, coding standards, and deployment options.

6.4 Pricing on request Visit site
15

Fluid Attacks

Free trial APILinuxMac+2

Choose Fluid Attacks when your organization needs combined automated application testing, expert services, risk controls, and remediation workflows.

6.3 Pricing on request · 21-day trial Visit site
16

Kiuwan Code Security

Free trial APILinuxMac+3

Kiuwan Code Security combines source scanning, customizable rules, quality gates and compliance reporting, with both cloud and on-premises analysis options.

6.2 From $49/user/mo (annual) Visit site
17

Black Duck Coverity

Paid LinuxMacSelf-hosted+2

Coverity pairs broad language and framework coverage with IDE, source-control, and CI integrations. Teams need to request a quote, and the facts list no free plan.

6.0 Pricing on request Visit site
18

DerScanner

Paid APILinuxSelf-hosted+2

Choose DerScanner if your team needs application security analysis across several artifact types, with deployment choices and development workflow integrations.

5.9 Pricing on request Visit site
19

HCL AppScan Source

Paid LinuxSelf-hostedWindows

Choose HCL AppScan Source if your security or development team needs source-code SAST with IDE and CI/CD integration, custom language support, and on-premises control.

5.6 Pricing on request Visit site
20

Snyk Code

Free plan Web

5.6 Free plan · paid from $25/mo Visit site
21

Qwiet AI

Paid APIExtensionLinux+3

Qwiet AI combines broad application security scanning with workflow integrations and optional fix suggestions.

5.5 Pricing on request · 45-day trial Visit site
22

ZeroPath

Paid APILinuxMac+3

ZeroPath brings broad application-security scanning and workflow integrations into one platform.

5.3 From $60/user/mo Visit site
23

Klocwork

Paid LinuxWebWindows

Choose Klocwork if your team needs source code analysis with pull request scans, IDE and CI/CD integration, custom rules, or automated fixes.

4.6 Pricing on request Visit site
24

OpenText Fortify SAST

Paid LinuxMacWeb+1

Choose OpenText Fortify SAST if your team needs static analysis across source code, bytecode, or binaries, with development workflow support and custom rules.

4.6 Pricing on request Visit site
25

Checkmarx One

Paid Web

4.5 Pricing on request Visit site

#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price

More in Developer Tools