FREEDOM251

Freedom251 › Developer Tools

Free and open first

Best Static Application Security Testing Sast in 2026

Static application security testing (SAST) tools examine application source for potential security problems. This list is for people choosing a code-scanning tool on a budget, including teams considering free or open-source software.

  1. 1

    gosec

    Free plan Open source APILinuxMac+1

    gosec offers configurable static security analysis for Go, with several output formats and CI integration options. Teams should review findings because automated detection can flag safe code.

    9.0 Free plan Visit site
  2. 2

    MobSF

    Free plan Open source APILinuxMac+3

    MobSF covers static and dynamic mobile-app analysis and offers pipeline integration. The free framework is available under GPL-3.0, while paid plans add services such as support and training.

    8.7 Free plan Visit site
  3. 3

    Semgrep Code

    Free plan Open source APIExtensionLinux+4

    Semgrep Code pairs static analysis with AI analysis and remediation guidance for findings.

    8.6 From $15/user/mo Visit site
  4. 4

    Flawfinder

    Free plan LinuxMacSelf-hosted+1

    Flawfinder offers risk-ranked checks for C/C++ source with several report formats and a patch-focused option. Treat it as an aid to security review, not a complete vulnerability detector.

    7.5 Free plan Visit site
  5. 5

    Bearer

    Free plan LinuxMac

    Choose Bearer CLI if you need a free source-code scanner that combines security checks with data-flow and privacy reporting.

    7.4 Free plan Visit site
  6. 6

    GitHub CodeQL

    Free plan ExtensionLinuxMac+3
    7.4 Free plan · paid from $30/mo Visit site
  7. 7

    Brakeman

    Free plan LinuxSelf-hosted

    Brakeman focuses on security analysis for Rails code and offers multiple ways to install, report results, and automate scans.

    7.3 Visit site
  8. 8

    Horusec

    Free plan APIExtensionLinux+4

    Horusec combines configurable static analysis with CLI, editor, and CI/CD workflows.

    7.3 Free plan Visit site
  9. 9

    GitHub Secret Scanning

    Free plan APISelf-hostedWeb

    Choose GitHub Secret Scanning if you need credential detection across repository history and related GitHub content, with options to block pushes and check credential validity.

    7.2 Free plan · paid from $19/mo Visit site
  10. 10

    NodeJsScan

    Free plan APILinuxMac+2

    NodeJsScan provides configurable source scanning with command-line, API, and web-interface options.

    7.1 Open source Visit site
  11. 11

    Joern

    Free plan APILinuxMac+2

    Choose Joern if you need an open-source platform for graph-based code analysis, customizable queries, or CI security scanners.

    6.9 Free plan Visit site
  12. 12

    Xygeni

    Free plan APIExtensionLinux+4

    Xygeni combines local scanning with supply-chain checks, secrets detection, and compliance audits. Its free tier has clear contributor, repository, and monthly scan limits to consider.

    6.9 Free plan Visit site
  13. 13

    CodeSonar

    Free trial LinuxSelf-hostedWeb+1

    Choose CodeSonar if you need static analysis across source code and binaries, with support for named security coverage, coding standards, and deployment options.

    6.5 Pricing on request Visit site
  14. 14

    Find Security Bugs

    Free plan LinuxMacWindows
    6.2 Free plan Visit site
  15. 15

    CodeThreat

    Free plan Web
    6.1 Free plan · paid from $39/mo Visit site
  16. 16

    Bandit

    Free plan
    6.0 Free plan Visit site
  17. 17

    HCL AppScan CodeSweep

    Free plan
    5.6 Free plan Visit site
  18. 18

    Mend SAST

    Paid LinuxMacSelf-hosted+2

    Choose Mend SAST if your team needs source code scanning across many languages, contextual prioritization, and remediation within development workflows.

    5.6 From $1,000/yr Visit site
  19. 19

    Snyk Code

    Free plan Web
    5.6 Free plan · paid from $25/mo Visit site
  20. 20

    Checkmarx SAST

    Paid LinuxWebWindows
    4.7 Pricing on request Visit site
  21. 21

    Klocwork

    Paid LinuxWebWindows

    Choose Klocwork if your team needs source code analysis with pull request scans, IDE and CI/CD integration, custom rules, or automated fixes.

    4.6 Pricing on request Visit site
  22. 22

    OpenText Fortify SAST

    Paid LinuxMacWeb+1

    Choose OpenText Fortify SAST if your team needs static analysis across source code, bytecode, or binaries, with development workflow support and custom rules.

    4.6 Pricing on request Visit site
  23. 23

    SecuSAST

    Paid LinuxMacWindows
    4.2 Pricing on request Visit site
  24. 24

    Veracode Static Analysis

    Paid Web
    4.0 Pricing on request Visit site

#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price

Assess free-plan details, trial conditions, entry-level paid prices, language coverage, IDE and CI/CD connections, deployment choices, custom-rule support, and pull-request checks. Before reading or modifying code, review its licence and make sure the platform suits your environment.

Questions

Can I use SAST tools for free?

Yes. Free plans appear among the entries, including free offerings from Bandit, Bearer, Flawfinder, gosec, and HCL AppScan CodeSweep.

Which SAST tools have paid pricing shown?

CodeThreat lists paid plans from $39 per month, GitHub CodeQL from $30 per month, and GitHub Secret Scanning from $19 per month.

Is source code available for any SAST tools here?

Some entries provide open-source code. Review the licence for a tool before reading, changing, or redistributing its code.

Do SAST tools offer free trials?

Some entries include a free trial. CodeSonar lists a free trial, while Brakeman lists no free trial.

Which platforms are covered?

The represented environments are Linux, web, Windows, macOS, self-hosted, and API deployments.

What features should I compare?

Review free-plan terms, entry-level paid pricing, language support, IDE and CI/CD connections, deployment, custom rules, and pull-request scanning.

More in Developer Tools