Static Code Analysis (SAST)

m14r41/scan4secrets

Find credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF,…

awarexone/agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

nealbridges/vulnhunter

Agentic AI security scanner that reasons like an attacker over source code, confirms exploitable flaws with executable PoCs, and drives test-first…

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

pycqa/bandit

Bandit is a tool designed to find common security issues in Python code.

linuztx/alter-zero

RAM efficient terminal agent harness for coding, cybersecurity, and automation.

s0md3v/hardcodes

find hardcoded strings from source code

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

openbreach/canop

Static analysis CLI that scans AI-generated code for vulnerabilities like SQL injection, unsafe reflection, and hardcoded secrets, with SARIF export…

openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm:…

auditinfra-io/o1js-scan

Dependency-free static analyzer for zk circuit soundness bugs in o1js/Mina zkApps and Noir circuits

analysis-tools-dev/static-analysis

Curated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code…

ajinabraham/njsscan

Semantic-aware SAST scanner for Node.js applications that detects insecure code patterns using libsast pattern matching and semgrep syntax-aware…

coffeeandsecurity/dakshscra

Framework-aware static code analysis tool for automated source code review with platform-specific rules, taint analysis, effort estimation, and…

bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

securego/gosec

Go security checker

semgrep/semgrep-rules

Static analysis rule pack for detecting security vulnerabilities, dangerous code patterns, and configuration issues across many languages; integrates…