Free and open first

Best Static Application Security Testing Software in 2026

Static application security testing software checks code for potential security issues as part of development work. Compare analysis targets and supported languages, then look at IDE and CI/CD support to understand how each tool may fit into your workflow. Fix guidance and SCA inclusion add further points of distinction; deployment, free-plan availability, and paid-from pricing are also listed. Skylos, Snyk Open Source, and Horusec are among the options, alongside Semgrep Code and Flawfinder. Match the listed language coverage and integrations to your codebase and process, and consider which deployment approach and guidance are useful to your team.

25 apps
Research read 23 Sept 2026
How the order is worked out

1

Bandit

Free plan Open source ExtensionLinuxMac+1

Bandit focuses on Python security linting, with options for baselines, formatted output, and integration into development workflows.

9.3 Free plan Visit site
2

gosec

Free plan Open source APILinuxMac+1

gosec offers configurable static security analysis for Go, with several output formats and CI integration options. Teams should review findings because automated detection can flag safe code.

9.0 Free plan Visit site
3

OpenGrep

Free plan Open source APILinuxMac+2

OpenGrep pairs broad language support with Semgrep rule compatibility and multiple analysis outputs. Note that deployment is self-hosted and the security policy covers only the latest version.

8.7 Free plan Visit site
4

Semgrep Code

Free plan Open source APIExtensionLinux+4

Semgrep Code pairs static analysis with AI analysis and remediation guidance for findings.

8.6 From $15/user/mo Visit site
5

Flawfinder

Free plan LinuxMacSelf-hosted+1

Flawfinder offers risk-ranked checks for C/C++ source with several report formats and a patch-focused option. Treat it as an aid to security review, not a complete vulnerability detector.

7.5 Free plan Visit site
6

Bearer

Free plan LinuxMac

Choose Bearer CLI if you need a free source-code scanner that combines security checks with data-flow and privacy reporting.

7.4 Free plan Visit site
7

GitHub CodeQL

Free plan ExtensionLinuxMac+3

7.4 Free plan · paid from $30/mo Visit site
8

Brakeman

Free plan LinuxSelf-hosted

Brakeman focuses on security analysis for Rails code and offers multiple ways to install, report results, and automate scans.

7.3 Visit site
9

Horusec

Free plan APIExtensionLinux+4

Horusec combines configurable static analysis with CLI, editor, and CI/CD workflows.

7.3 Free plan Visit site
10

Dawnscanner

Free plan LinuxSelf-hosted

Dawnscanner combines framework-aware Ruby checks with view-code analysis and mitigation guidance. Its text-only results and separate knowledge-base download are worth considering before adopting it.

7.2 Open source Visit site
11

Microsoft DevSkim

Free plan APIExtensionLinux+3

DevSkim offers IDE, CLI, and library options for security linting, with custom rules and several result formats.

7.2 Free plan Visit site
12

MobSF

Free plan AndroidAPIiPhone+3

MobSF offers static, dynamic and malware analysis with reporting and CI/CD integration.

7.2 Free plan Visit site
13

Puma Scan

Free plan LinuxMacSelf-hosted+1

Puma Scan provides Visual Studio scanning for supported C# projects and pipeline options for automated checks.

7.1 Free plan · paid from $299/user/yr · 30-day trial Visit site
14

Pysa

Free plan ExtensionLinuxMac+2

Pysa offers configurable taint analysis, CI support, and a local findings workflow at no cost.

7.0 Open source Visit site
15

Skylos

Free plan APIExtensionLinux+4

Skylos offers local analysis alongside cloud workflows, with clear distinctions about when scan data is uploaded. Review language coverage and cloud limits to see whether they fit your workflow.

7.0 Free plan · paid from $9 · 7-day trial Visit site
16

PVS-Studio

Free plan LinuxMacWindows

Choose PVS-Studio if your team needs multi-language source analysis, security checks, and integrations with development tools.

6.9 Pricing on request · 7-day trial Visit site
17

CodeSonar

Free trial LinuxSelf-hostedWeb+1

Choose CodeSonar if you need static analysis across source code and binaries, with support for named security coverage, coding standards, and deployment options.

6.4 Pricing on request Visit site
18

Black Duck Coverity

Paid LinuxMacSelf-hosted+2

Coverity pairs broad language and framework coverage with IDE, source-control, and CI integrations. Teams need to request a quote, and the facts list no free plan.

6.0 Pricing on request Visit site
19

Mend SAST

Paid LinuxMacSelf-hosted+2

Choose Mend SAST if your team needs source code scanning across many languages, contextual prioritization, and remediation within development workflows.

5.7 From $1,000/yr Visit site
20

HCL AppScan Source

Paid LinuxSelf-hostedWindows

Choose HCL AppScan Source if your security or development team needs source-code SAST with IDE and CI/CD integration, custom language support, and on-premises control.

5.6 Pricing on request Visit site
21

Snyk Code

Free plan Web

5.6 Free plan · paid from $25/mo Visit site
22

Checkmarx SAST

Paid LinuxWebWindows

4.7 Pricing on request Visit site
23

Klocwork

Paid LinuxWebWindows

Choose Klocwork if your team needs source code analysis with pull request scans, IDE and CI/CD integration, custom rules, or automated fixes.

4.7 Pricing on request Visit site
24

njsscan

Paid LinuxMac

4.3 Open source Visit site
25

Veracode Static Analysis

Paid Web

4.0 Pricing on request Visit site

#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price

More in Developer Tools