sast

⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

nodejsscan is a static security code scanner for Node.js applications.

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

IDEA静态代码安全审计及漏洞一键修复插件

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

基于pytorch的ocr算法库，包括 psenet, pan, dbnet, sast , crnn

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan Community Edition (CE)

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

A declarative static analysis tool for jvm bytecode based Datalog like CodeQL

Django application that performs SAST and Malware Analysis for Android APKs

Fully open-source SAST scanner supporting a range of languages and frameworks. Integrates with major CI pipelines and IDE such as Azure DevOps, Google CloudBuild, VS Code and Visual Studio. No server required!

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

鹏 RocB - Java代码审计IDEA插件 SAST

The only open-source tool to analyze vulnerabilities and configuration issues with running docker container(s) and docker networks.

《深入理解SAST静态应用安全测试》Static Application Security Testing.