sast

Star

Here are 259 public repositories matching this topic...

Language:All

Filter by language

All259 Python61 Java26 Go24 Shell22 JavaScript21 TypeScript12 C#7 Dockerfile6 HTML6 Rust6

Sort:Most stars

Sort options

Most stars Fewest stars Most forks Fewest forks Recently updated Least recently updated

analysis-tools-dev /static-analysis

Sponsor

Star13.7k

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

analysis static-code-analysis linter static-analysis awesome-list code-quality static-analyzers hacktoberfest sast

UpdatedMar 10, 2025
Rust

semgrep /semgrep

Star11.3k

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

javascript ruby python c java go typescript static-code-analysis static-analysis sast r2c semgrep

UpdatedMar 18, 2025
OCaml

tenable /terrascan

Star4.9k

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

kubernetes infrastructure aws security devops terraform architecture iac infrastructure-as-code scans aws-security security-tools cloudsecurity devsecops cloud-security sast azure-security gcp-security terrascan security-violations

UpdatedDec 10, 2024
Go

ajinabraham /nodejsscan

Sponsor

Star2.4k

nodejsscan is a static security code scanner for Node.js applications.

nodejs javascript lint security node static-analysis code-analysis code-review security-scanner devsecops sast node-security nodejsscan

UpdatedMar 5, 2025
CSS

Bearer /bearer

Star2.2k

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

security security-audit privacy static-code-analysis static-analysis owasp dataflow vulnerability code-quality compliance vulnerabilities appsec security-scanner gdpr security-automation security-tools devsecops sast devsecops-tools

UpdatedMar 17, 2025
Go

ASTTeam /CodeQL

Star1.6k

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

ql devsecops sast semmle-ql codeql codeql-queries 0e0w learning-codeql hackjava hackaspx javasec hackgolang

UpdatedNov 21, 2023

ZupIT /horusec

Star1.2k

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

ruby kotlin python java cli golang security analysis ci cd terraform scanner static-analysis netcore vulnerabilities hacktoberfest sast security-flaws security-development sast-analysis

UpdatedMar 15, 2025
Go

momosecurity /momo-code-sec-inspector-java

Star1k

IDEA静态代码安全审计及漏洞一键修复插件

java idea sast

UpdatedMar 10, 2022
Java

tcosolutions /betterscan

Star851

Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan

devops security-audit static-code-analysis static-analysis sonarqube owasp vulnerability code-quality compliance devops-tools static-analyzers security-scanner gdpr security-orchestration security-automation security-tools devsecops vulnerability-scanner sast code-quality-analyzer

UpdatedMar 17, 2025
Python

ShiftLeftSecurity /sast-scan

Star834

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

workflow appsec scanners license-scan devsecops sast dependency-scan

UpdatedSep 1, 2023
Python

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

security static-analysis owasp penetration-testing code-review infosec pentesting static-analyzer android-security pentest information-security secure-coding security-tools sast pentesting-tools owasp-mobile-top mstg masvs mobile-sec-android apkhunt

UpdatedJan 17, 2025
Go

BADBADBADBOY /pytorchOCR

Star679

基于pytorch的ocr算法库，包括 psenet, pan, dbnet, sast , crnn

ocr textrecognition sast crnn dbnet textdetection psenet pannet

UpdatedMay 19, 2021
C++

MobSF /mobsfscan

Star647

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

android kotlin java swift security ios objective-c static-analysis codereview appsec sast mobile-sast

UpdatedJan 31, 2025
Python

insidersec /insider

Star526

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Ful…

nodejs javascript android kotlin swift cli ios csharp maven dotnet static-analysis owasp static-analyzer android-security ios-security security-scanner security-automation security-tools sast insider

UpdatedApr 10, 2022
Go

ajinabraham /njsscan

Sponsor

Star391

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

nodejs lint python security semantic linter static-analysis expressjs jslint static-analyzer codereview appsec staticanalysis security-tools devsecops sast nodesecurity nodejsscan codescanner njsscan

UpdatedNov 14, 2024
JavaScript

DeepSourceCorp /globstar

Star385

Globstar is a fast, feature-rich, and open-source static analysis toolkit for writing and running code checkers. Based on tree-sitter.

tree-sitter static-analysis code-quality sast code-security

UpdatedMar 18, 2025
Go

alipay /ant-application-security-testing-benchmark

Star375

xAST评价体系，让安全工具不再“黑盒”. The xAST evaluation benchmark makes security tools no longer a "black box".

testing security application benchmark evaluation sca iast sast dast

UpdatedMar 4, 2025
Java

Chanzi-keji /chanzi

Star362

"chanzi" is a simple and user-friendly JAVA SAST tool that utilizes taint analysis technology, includes built-in common vulnerability rules, supports decompile, custom rule, and is compatible with the technology stacks of Servlet&filter, Spring,struts,Dubbo,Thrift, jax-rs,jax-ws,JFinal,Netty,MyBatis,and JSP.

java security static-analysis static-analyzer static-analyzers security-tools java-security sast javasecurity java-code-quality java-scanner java-seckill java-sec javasec static-analysis-tools