Microsoft DevSkim vs Puma Scan
Microsoft DevSkim
github.comPuma Scan
pumasecurity.ioSide by side
| Figure | Microsoft DevSkim | Puma Scan |
|---|---|---|
| Price from | Free | $24.92/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 5 |
| Spec score · Static Application Security Testing Software | 7.9 (#12) | 8.1 (#9) |
| Intended users | The project describes its goal as helping developers identify and fix security vulnerabilities early and build security awareness. | Puma Scan describes its product as created for .NET security engineers and developers and positions pipeline editions for development, security, and operations teams. |
| Purpose | DevSkim provides IDE plugins, language analyzers, and rules for security linting and static source-code analysis. | Puma Scan is a static application security testing tool that scans C# code in Visual Studio and reports vulnerabilities as compiler warnings before code is committed. |
| Support | Support is limited to GitHub issues and the project wiki resources listed in its support policy. | The Professional End User Edition includes email support and scheduled telephone support; the annual subscription includes product support and updates. |
Plans
Puma Scan
- CommunityFree
- End User$299 a year
- Server$4,999 a year
- Cloud CI Standard$5,999 a year
- Cloud CI Unlimited$10,999 a year
In their own words
Microsoft DevSkim
Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis. It provides IDE extensions, language analyzers, and rules to help developers identify and address security vulnerabilities early. It includes built-in rules and allows teams to write their own using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as binaries for Windows, macOS, and Linux. A C# library is also available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text; the CLI can apply suggested fixes from SARIF results and add suppression comments. The project lists extensions for Visual Studio Code and Visual Studio, and supports CI/CD in self-hosted environments. Support is limited to GitHub issues and project wiki resources. Vulnerability reports should be sent privately to Microsoft's Security Response Center rather than posted publicly.
Puma Scan
Puma Scan is a static application security testing tool for C# code in Visual Studio. Its End User Edition scans code as developers write and reports vulnerabilities as compiler warnings before a commit. The extension supports C# in.NET Framework and.NET Core, including Web Forms and MVC; legacy website projects are unsupported. The product page says it also scans AI-generated code from GitHub Copilot, Cursor, Claude, ChatGPT, Amazon Q and Gemini Code Assist. For automated scanning, listed integrations include GitHub Actions, GitLab CI and Azure DevOps. CI editions can enforce configurable vulnerability severity thresholds and stop builds when requirements are not met. The Server Edition supports command-line scans, on-premises Azure DevOps build tasks and exports in HTML, JSON, MSBuild, VSO, VSTest and CSV formats. Community is free. End User costs $299 a year; Server is $4,999 a year, Cloud CI Standard $5,999 a year and Cloud CI Unlimited $10,999 a year. Trials last 30 days, require no credit card and do not include reporting. Community analyzers run locally and do not contact Puma Scan servers for rule updates.