#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
ajinabraham/njsscanSemantic-aware SAST scanner for Node.js applications that detects insecure code patterns using libsast pattern matching and semgrep syntax-aware…
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
aftermathlabs/vmp2Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…
mandiant/route-sixty-sinkLink sources to sinks in C# applications.
feeicn/cobraSource Code Security Audit (源代码安全审计)
tenable/terrascanDetect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
novoda/gradle-static-analysis-pluginEasy setup of static analysis tools for Android and Java projects.
sonatype-nexus-community/devauditOpen-source, cross-platform, multi-purpose security auditing tool
skyscanner/lambdaguardAWS Serverless Security
praetorian-inc/gokartA static analysis tool for securing Go code
iqtlabs/auraborealisappDo You Know What's In Your Python Packages? A Tool for Visualizing Python Package Registry Security Audit Data
owasp/riskassessmentframeworkThe Secure Coding Framework
coatisoftware/sourcetrailSourcetrail - free and open-source interactive source explorer
