Skip to content
SPECIFICTION
Get listed

Security Code Scan

security-code-scan.github.io

Free plan WindowsLinuxSelf-hosted
Visit security-code-scan.github.io
Spec score 7.4 #19 of 26 in SAST Tools

What it is

Security Code Scan is a free, open-source static analyzer for .NET projects written in C# and VB.NET. It detects vulnerability patterns such as SQL injection, cross-site scripting, CSRF, and XML external entity injection, using inter-procedural taint analysis to follow input data. Projects can be analyzed in the background through IntelliSense or during a build. For delivery workflows, it supports GitHub and GitLab pipelines, MSBuild, and a stand-alone runner; custom integrations can emit SARIF results and place warnings alongside other build messages. Users can define taint sources, sinks, sanitizers, validators, and project-specific settings. The analyzer supports Visual Studio 2019 or higher, while the project says other Roslyn analyzer editors such as Rider or OmniSharp should work. Releases are available as a NuGet package, Visual Studio extension, and stand-alone runner for Windows and Linux. The maker warns that the extension or NuGet package can slow the IDE and recommends CI/CD pipelines as the more common use case. Audit mode is off by default. The repository identifies an LGPL-3.0 license.

Spec sheet

Purpose
Security Code Scan is a static code analyzer for .NET that detects vulnerability patterns in C# and VB.NET.Read 9 Oct 2026 · security-code-scan.github.io
Integrations
The site lists GitHub and GitLab pipeline support, plus MSBuild and a stand-alone runner for custom integrations.Read 9 Oct 2026 · security-code-scan.github.io
Support
The maker provides a troubleshooting guide and directs users to project issues and contributions on GitHub.Read 9 Oct 2026 · github.com
License
The project repository identifies its license as LGPL-3.0.Read 9 Oct 2026 · github.com
CI recommendation
The maker says CI/CD is the more common use case and recommends pipeline integrations for that use.Read 9 Oct 2026 · security-code-scan.github.io
Customization
Users can configure custom taint sources, sinks, sanitizers, validators, and project-specific settings.Read 9 Oct 2026 · security-code-scan.github.io
Detection
It detects patterns including SQL injection, cross-site scripting, CSRF, and XML external entity injection.Read 9 Oct 2026 · security-code-scan.github.io
Downloads
Official releases are offered as a NuGet package, a Visual Studio extension, and a stand-alone runner.Read 9 Oct 2026 · github.com
Editors
It supports Visual Studio 2019 or higher and says other Roslyn analyzer editors such as Rider or OmniSharp should work.Read 9 Oct 2026 · security-code-scan.github.io
Limitations
Audit mode is off by default and can produce more warnings about data with unknown taint state when enabled.Read 9 Oct 2026 · security-code-scan.github.io
Performance
The maker warns that installing it as a Visual Studio extension or NuGet package can slow the IDE because it performs extensive static analysis.Read 9 Oct 2026 · security-code-scan.github.io
Results
For custom integrations, it can produce SARIF results and show warnings alongside other build messages.Read 9 Oct 2026 · security-code-scan.github.io
Taint analysis
The analyzer performs inter-procedural taint analysis for input data.Read 9 Oct 2026 · security-code-scan.github.io
Usage
It analyzes projects in the background as IntelliSense or during a build.Read 9 Oct 2026 · security-code-scan.github.io

Plans and prices

Security Code Scan Free Open source static analyzer for .NET Read 9 Oct 2026 · security-code-scan.github.io

Every Security Code Scan plan and price →

Strong points and limits

Strong points

  • Analyzes C# and VB.NET vulnerability patterns
  • Inter-procedural taint analysis
  • GitHub and GitLab pipeline support
  • Configurable taint and validation rules
  • Free, open-source LGPL-3.0 project

Limits

  • IDE or NuGet use can slow Visual Studio
  • Automated fixes are not provided
  • Audit mode can add unknown-taint warnings

Who it suits

It suits .NET developers and teams wanting vulnerability analysis during builds or in CI/CD. Custom rules and SARIF output help teams fitting the scanner into tailored security workflows.

Verdict

Security Code Scan focuses on static .NET analysis with configurable taint rules and several build-pipeline options. CI/CD is the recommended setting, while IDE installations may affect responsiveness.

Where Specifiction places it

Alternatives to Security Code ScanAll alternatives →