Static Code Analysis (SAST)

facebook/infer

A static analyzer for Java, C, C++, and Objective-C

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

github/codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

phpstan/phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

sonarsource/sonarqube

Code-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…

bridgecrewio/checkov

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm:…

pycqa/bandit

Bandit is a tool designed to find common security issues in Python code.

securego/gosec

Go security checker

pmd/pmd

An extensible multilanguage static code analyzer.

awarexone/agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

zrax/pycdc

C++ python bytecode disassembler and decompiler

lirantal/awesome-nodejs-security

Curated directory of Node.js security tools, static analyzers, vulnerability scanners, and educational resources covering OWASP Top 10, supply chain…

gadievron/raptor

Autonomous security research framework integrating static analysis, binary analysis, fuzzing, LLM-powered vulnerability validation, exploit…

semgrep/semgrep-rules

Static analysis rule pack for detecting security vulnerabilities, dangerous code patterns, and configuration issues across many languages; integrates…

stackrox/kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…