Static Code Analysis (SAST)

stackrox/kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…

openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm:…

phpstan/phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

sonarsource/sonarqube

Code-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…

pmd/pmd

An extensible multilanguage static code analyzer.

knostic/openant

OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws…

gadievron/raptor

Autonomous security research framework integrating static analysis, binary analysis, fuzzing, LLM-powered vulnerability validation, exploit…

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

checkmarx/kics

Static analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…

github/codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

promptfoo/modelaudit

Security scanner for AI/ML model files. Detects malicious code, backdoors, and vulnerabilities before deployment

analysis-tools-dev/static-analysis

Curated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code…

securego/gosec

Go security checker

0xdea/haruspex

Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.

awarexone/agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

facebook/infer

A static analyzer for Java, C, C++, and Objective-C

gitlab-org/security-products/sast-rules

Curated Semgrep rule repository for GitLab SAST, providing static analysis patterns to detect security vulnerabilities across multiple programming…