#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
david-a-wheeler/flawfindera static analysis tool for finding vulnerabilities in C/C++ source code
owasp/asstOWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.
kira2040k/php_code_analysisStatic PHP code scanner that detects SQL injection, XSS, SSRF, LFI, command injection, insecure deserialization, and other web vulnerabilities in…
mhaskar/bughoundStatic code analysis tool based on Elasticsearch
doyensec/regexploitFind regular expressions which are vulnerable to ReDoS (Regular Expression Denial of Service)
redsection/jspandaclient-side prototype pullution vulnerability scanner
agrawalsmart7/scodescannerCommand-line static analysis scanner that detects critical vulnerabilities in PHP and YAML source code using custom semgrep rules, with Jira and…
designsecurity/progpilotPHP static application security testing (SAST) tool that performs taint analysis to detect XSS, SQL injection, and other vulnerabilities using…
shubhamshubhankar/autosourceAutomated static code analysis framework integrated with SonarQube for early vulnerability detection in source code by scanning Git repositories…
squid-protocol1/gitgalaxyAST-free heuristic knowledge graph engine for deep repository intelligence and zero-trust security scanning. Integrates as a GitLab CI/CD component,…
gitlab-org/security-products/sast-rulesCurated Semgrep rule repository for GitLab SAST, providing static analysis patterns to detect security vulnerabilities across multiple programming…
mustafabilgici/sucoshscanny"Sucosh" is an automated Source Code vulnerability scanner and assessment framework for Python(Flask-Django) & NodeJs capable of performing code…
noveogroup/android-checkStatic code analysis plugin for Android project. (Checkstyle, PMD)
facebook/inferA static analyzer for Java, C, C++, and Objective-C
coffeeandsecurity/dakshscraFramework-aware static code analysis tool for automated source code review with platform-specific rules, taint analysis, effort estimation, and…
makenowjust-labs/recheckStatic analysis tool for detecting ReDoS (Regular Expression Denial of Service) vulnerabilities in JavaScript and Scala codebases, providing…
whitesquirrell/c0devari4ntA variant analysis and visualisation tool that scans codebases for similar vulnerabilities
tencent/codeanalysisEnterprise-grade static code analysis platform with multi-language support, security vulnerability detection, code quality metrics, and DevOps…
