Puma Scan

Puma Scan is a static application security testing tool for.NET teams that want C# vulnerability checks in Visual Studio and CI. Its strongest case is early feedback for C# developers plus controls for teams that gate builds; it is a narrower fit for organizations using other languages or editors.

Overview

The End User Edition puts scan findings into Visual Studio as compiler warnings while developers write code, before changes are committed. That makes Puma Scan most useful when the team can act on findings within its normal.NET workflow. Pipeline editions extend scanning to automated builds, where configurable severity thresholds can stop a build that misses security requirements.

Key features

The Visual Studio extension supports C# in.NET Framework and.NET Core, including Web Forms and MVC. It does not support legacy Web Site projects, and the End User extension does not work in cross-platform editors such as VS Code. Those are consequential boundaries: teams with mixed editor standards or older project types should not assume the developer-side scan will cover their code.

Puma Scan says its scanner covers AI-generated code from GitHub Copilot, Cursor, Claude, ChatGPT, Amazon Q and Gemini Code Assist. That may help teams using those assistants keep scans in the same workflow, but static analysis is not definitive; the maker warns that findings can include false positives and false negatives and documents its vulnerability-analysis rules.

For CI, integrations include GitHub Actions, GitLab CI and Azure DevOps. Server Edition adds command-line scans and an on-premises Azure DevOps build task, plus exports in HTML, JSON, MSBuild, VSO, VSTest and CSV. Community Edition analyzers run locally in Visual Studio and do not contact Puma Scan servers for rule updates, a useful privacy characteristic but one that means they do not obtain remote rule updates.

Pricing

Community is free for open source projects. It provides local Visual Studio analyzers, but is not the paid support-and-updates subscription. It is the natural starting point for eligible open source work; teams needing named-user licensing or pipeline capacity should compare the paid editions.

End User costs $299 a year, billed annually. The license is valid for one year and renews annually; it covers 1 named user on up to 3 workstations. This is the clearest fit for an individual developer who wants the Visual Studio scanning workflow. The Professional End User Edition includes email and scheduled telephone support, and the annual subscription includes product support and updates.

Server costs $4,999 a year with annual renewal. It covers up to 5 build agents and includes 5 End User licenses; additional bundles of 5 build agents cost $1,000. This suits teams wanting command-line or on-premises Azure DevOps scanning and export options, but the agent cap matters for larger build fleets.

Cloud CI Standard costs $5,999 a year with annual renewal, includes 5 End User licenses and supports up to 20 build pipelines. Cloud CI Unlimited costs $10,999 a year with annual renewal, includes the same 5 End User licenses and allows unlimited scanning within one organization. Standard is the more bounded choice for teams within its pipeline ceiling; Unlimited removes that ceiling for one organization, at a higher annual cost.

The product page offers 30-day trials without a credit card, but reporting is unavailable during the trial. That makes the trial useful for evaluating scanning, not for assessing its report exports.

Platforms

Puma Scan's stated platforms are Linux, macOS, Windows and self-hosted deployment. The End User extension itself is tied to Visual Studio and C# rather than cross-platform code editors, so the broad platform list should not be read as support for VS Code.

Who it's for

Puma Scan is aimed at.NET security engineers and developers, with pipeline editions also positioned for development, security and operations teams. Choose it when C# in Visual Studio is central and the team wants findings during coding or severity-based build gates. Look elsewhere if the requirement is broad language coverage, support for legacy Web Site projects or editor choice beyond Visual Studio.

Pros and cons

Pros: Real-time C# findings in Visual Studio put feedback before commit, and CI severity thresholds can enforce build requirements.

Pros: Server Edition combines command-line and on-premises Azure DevOps integration with several report export formats.

Cons: The End User extension excludes VS Code and legacy Web Site projects, limiting teams with those tools or project types.

Cons: Community Edition does not obtain rule updates from Puma Scan servers, while trials omit reporting; neither is a full substitute for evaluating supported paid workflows.

Cons: Server and Cloud CI editions carry substantial annual prices, and Server has a 5-agent base limit.

Alternatives

Compare static application security testing software if you want to weigh Puma Scan against a broader field of tools.

Skylos is worth considering for a freemium option with local CLI scans and a cloud tier limited to one project, 10 stored scans and 7 days of history.

Snyk Open Source is a better match when software-composition analysis is the priority: its free plan covers 5 projects and access to Snyk Open Source (SCA).

Horusec is a free, Apache License 2.0 open-source option with CLI and platform components.

Pysa is the relevant free alternative for Python static analysis, distributed under the MIT license and installed with pip.

Semgrep Code may suit teams seeking code and supply-chain scanning in a free tier capped at 10 repositories and 10 contributors, with 60 AI credits.

MobSF is a free GPL v3 alternative for Android and iOS application security testing.

Veracode DAST is an alternative for web applications and APIs, with pricing available by contacting the vendor.

Microsoft DevSkim is a free MIT-licensed alternative offering a library, CLI and IDE extensions.

Verdict

Choose Puma Scan if your team develops C# in Visual Studio and wants security findings before commit, with optional CI thresholds and reporting for build workflows. Its focused.NET workflow is the main reason to choose it; its editor and project restrictions, plus annual pipeline costs, are the main reasons to look elsewhere.