Static Code Analysis (SAST)

analysis-tools-dev/static-analysis

Curated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code…

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

facebook/infer

A static analyzer for Java, C, C++, and Objective-C

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

github/codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

phpstan/phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

sonarsource/sonarqube

Code-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…

bridgecrewio/checkov

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm:…

pycqa/bandit

Bandit is a tool designed to find common security issues in Python code.

securego/gosec

Go security checker

pmd/pmd

An extensible multilanguage static code analyzer.

zrax/pycdc

C++ python bytecode disassembler and decompiler

lirantal/awesome-nodejs-security

Curated directory of Node.js security tools, static analyzers, vulnerability scanners, and educational resources covering OWASP Top 10, supply chain…

awarexone/agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

microsoft/applicationinspector

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…

gadievron/raptor

Autonomous security research framework integrating static analysis, binary analysis, fuzzing, LLM-powered vulnerability validation, exploit…

stackrox/kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…