SAST Tools
Alternatives to Bandit
The tools Specifiction weighs against Bandit, from its list of sast tools, each with its plans, platforms and spec score.
- 01 MobSF
MobSF suits teams and individuals analyzing mobile apps for security and privacy, including those integrating scans into CI/CD workflows.
From $250/mo Free plan Open source Web · Windows · macOS · Linux9.0 Visit Specs - 02
Semgrep Code It suits development teams that want code vulnerability findings and remediation guidance in pull requests, IDEs, or CI workflows.
From $15/mo Free plan Open source Web · Windows · macOS · Linux8.7 Visit Specs - 03 gosec
gosec suits Go developers and security teams scanning source code locally or in CI/CD.
Free plan Open source macOS · Linux · API · Self-hosted8.6 Visit Specs - 04
GitHub CodeQL From $30/mo Free plan Web · Windows · macOS · Linux8.5 Visit Specs - 05
NaiveSystems Analyze The tool is aimed at DevOps and DevSecOps teams, including automotive, medical device, and embedded development use cases.
Free plan Open source Windows · macOS · Linux · Self-hosted8.4 Visit Specs - 06
Kiuwan Code Security Kiuwan Code Security suits development teams seeking to find and address source-code vulnerabilities during development and before deployment.
From $4.08/mo Free trial Web · Windows · macOS · Linux8.2 Visit Specs - 07
CodeSonar CodeSonar suits development and security teams analyzing source and binaries across multiple languages, especially where coding standards, CI/CD workflows or safety-qualified projects matter.
Free trial Web · Windows · Linux · Self-hosted8.1 Visit Specs - 08
Flawfinder It suits developers looking for potential security problems in C or C++ application source before release.
Free plan Windows · macOS · Linux · Self-hosted8.1 Visit Specs - 09 Brakeman Free plan Linux · Self-hosted8.0 Visit Specs
- 10
Fluid Attacks Fluid Attacks is intended for security, development and fraud teams that need to identify and address software vulnerabilities.
Free trial Web · Windows · macOS · Linux7.9 Visit Specs - 11
Black Duck Coverity Coverity suits enterprise development teams that need static source-code analysis across languages and frameworks.
Web · Windows · macOS · Linux7.8 Visit Specs - 12 NodeJsScan
NodeJsScan suits teams that want to scan Node.js source code in CI/CD or DevSecOps workflows.
Free plan Web · macOS · Linux · API7.8 Visit Specs - 13
Qwiet AI Web · Windows · macOS · Linux7.8 Visit Specs - 14
Bearer Bearer suits developers and security teams scanning source code for security, privacy, sensitive-data, or hard-coded-secret risks.
Free plan macOS · Linux7.7 Visit Specs - 15
Joern It suits security researchers and development teams building code analysis or custom security checks, including CI workflows.
Windows · macOS · Linux · API7.7 Visit Specs - 16
DerScanner Web · Windows · Linux · API7.6 Visit Specs - 17
PVS-Studio It suits developers and teams who want source-code analysis across the listed languages and operating systems.
Free trial Windows · macOS · Linux7.4 Visit Specs - 18 Security Code Scan
It suits .NET developers and teams wanting vulnerability analysis during builds or in CI/CD.
Free plan Windows · Linux · Self-hosted7.4 Visit Specs - 19
ZeroPath From $1,000/mo Web · Windows · macOS · Linux7.3 Visit Specs - 20 HCL AppScan Source Windows · Linux · Self-hosted7.2 Visit Specs
- 21
Checkmarx One It suits development and security teams that want source-code checks integrated with CI/CD, pull requests, and IDE workflows.
Web5.9 Visit Specs - 22
Klocwork Web · Windows · Linux5.9 Visit Specs - 23 OpenText Fortify SAST Web · Windows · macOS · Linux5.8 Visit Specs
- 24 Snyk Code Web5.3 Visit Specs
- 25 Veracode Static Analysis Web5.3 Visit Specs