Best SAST Tools in 2026: Free, Open-Source and Commercial, Compared

The best SAST tools in 2026 for most software teams are GitHub CodeQL, Semgrep, SonarQube, Snyk Code and Checkmarx One. Enterprises that need binary scanning, on-premises deployment or safety-critical C and C++ should add Veracode, OpenText Fortify and Black Duck Coverity to the shortlist. The best free options are Semgrep Community Edition, its fork Opengrep, CodeQL on public repositories, and specialists such as Bandit, gosec and Brakeman. Which one fits depends on how deeply it understands your languages, how much noise it makes, and where your code already lives.

Disclosure: Invadel sells no tool and earns no commission on any below. We review source code for a living, and where the tools stop, our secure code review picks up at a fixed price from $4,800 (pricing tiers). Vendor facts were checked on vendor sites in November 2026.

What static application security testing tools do

Static application security testing reads source code or bytecode without running it and follows untrusted input from where it enters to where it can do damage, such as a query or a shell command. Every engine flags dangerous code shapes like weak cryptography or hardcoded secrets. The difference is how far it follows data: single-function engines, such as Semgrep Community Edition, are fast but lose the trail at a function or file boundary, while interprocedural engines track input across functions and files, so they catch the injection that passes through a controller, a service and a data layer before reaching the query. For definitions and how SAST compares with DAST and IAST, see SAST vs DAST vs IAST.

SAST tools compared at a glance

Tool	Languages (vendor figure)	Deepest analysis	Deployment	Published price
GitHub Code Security (CodeQL)	CodeQL: 10 families, no PHP; AI Scan covers others	Semantic dataflow	GitHub	$30 per committer a month on Team or Enterprise; free on public repos
Semgrep Code	18 generally available	Cross-file in 8 languages	Cloud, CLI in CI	Free to 10 contributors, then $30 each a month
SonarQube	35+	Taint analysis from Developer Edition	Cloud or self-hosted	Cloud free to 50,000 lines, Team from $34 a month
Snyk Code	Not given as a count	Interfile, all but Ruby	Cloud, IDE	Free tier; Team from $25 a month, up to 10 developers
Checkmarx One	Not given; includes COBOL	Rules plus AI engine	Cloud or on-premises	Not published
Veracode	100+ languages and frameworks	Source, binary, hybrid	Vendor platform	Not published
OpenText Fortify SAST	44+ languages	1,524+ vulnerability categories	SaaS, private or on-premises	Not published
Black Duck Coverity	22 languages	MISRA, AUTOSAR, CERT checks	On-premises or SaaS	Not published
GitLab SAST	15+	Cross-file in Ultimate only	GitLab CI	Basic scanning in every tier
Aikido	Major languages	Rules plus AI triage	Cloud	Free for 2 users, $300 a month for 10
Invadel code review	Major web, mobile, backend stacks	AI triage plus manual review	Service	From $4,800 fixed, free re-review

Vendors count languages differently; treat the figures as a hint. The Semgrep, SonarQube and Aikido prices were re-checked on each vendor’s pricing page on November 11, 2026; the rest were checked earlier in November 2026.

How we chose these SAST tools

A tool is listed if it does static analysis of source code or bytecode for security flaws and its vendor or project documents language coverage and analysis depth on its own site, which is where every fact here was checked. No vendor paid to be included. The order is our view of how many teams each tool fits, not a benchmark.

The best commercial SAST tools

1. GitHub Code Security (CodeQL)

Best for: teams whose code lives on GitHub. CodeQL runs semantic queries that follow data across functions and files. It covers C and C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift and Actions workflows, and GitHub names PHP and Scala as unsupported (CodeQL languages). It is free on public repositories; private ones need GitHub Code Security, which includes Copilot Autofix and SARIF upload from other scanners and is a $30 per active committer a month add-on to a GitHub Team or Enterprise plan; an AI Scan for pull requests in languages CodeQL does not cover uses AI credits (GitHub security plans).

2. Semgrep Code

Best for: teams that want to write their own rules. Semgrep rules look like the code they match, so encoding “never call this without that check” is quick. The paid engine adds cross-file dataflow for eight languages and cross-function analysis for seven more (Semgrep languages). It is free for 10 contributors and 10 private repositories, then $30 per contributor a month for Code, $30 for Supply Chain and $15 for Secrets (Semgrep pricing).

3. SonarQube

Best for: one quality gate for code quality and security. Sonar’s taint analysis traces data from source to sink across files and methods (Sonar SAST). Injection detection starts at Developer Edition, for nine languages including Java, C#, Python and PHP, while the free Community Build finds basic vulnerabilities only (SonarQube editions). SonarQube Cloud is free to 50,000 private lines and its Team plan starts at $34 a month for 100,000; Server is priced per instance by lines of code (Sonar pricing).

4. Snyk Code

Best for: developer-first teams already using Snyk for dependencies. An AI-based engine follows data from source to sink, with interfile analysis for every supported language except Ruby, plus IDE plugins (Snyk Code docs). The free plan includes 100 Snyk Code tests a month and Team starts at $25 a month; Enterprise is quoted on a credit system (Snyk plans).

5. Checkmarx One

Best for: large enterprises with many languages, including legacy ones. Checkmarx names Java, JavaScript, Python, C#, Go and COBOL among its languages (Checkmarx SAST). On the Checkmarx One platform it adds an AI-based engine to the rules engine; the on-premises product uses rules only. Checkmarx publishes no list price and prices One per package (Checkmarx pricing).

6. Veracode Static Analysis

Best for: scanning code you ship but cannot share as source. Veracode offers source, binary and hybrid scanning, so it can analyze third-party components without source, and claims 100+ languages and frameworks (Veracode SAST). Pricing is not published.

7. OpenText Fortify SAST

Best for: regulated enterprises that need on-premises or private hosting. Fortify assesses 1,524+ vulnerability categories across 44+ languages and 350+ frameworks, and runs as SaaS through Fortify on Demand, private hosted or fully on-premises (OpenText Fortify SAST). Pricing is not published.

8. Black Duck Coverity

Best for: C, C++ and embedded code, including safety-critical software. Coverity supports 22 languages and checks MISRA, AUTOSAR C++14 and CERT rules (Black Duck Coverity). It runs air-gapped on premises or as SaaS through Polaris. Pricing is a custom quote.

9. GitLab SAST

Best for: teams that ship on GitLab. SAST is in every tier through a Semgrep-based analyzer covering C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, TypeScript and more (GitLab SAST docs). Cross-file, cross-function scanning needs GitLab Advanced SAST, which is Ultimate only, so lower tiers will miss injection that crosses files.

10. Aikido

Best for: small teams that want one inexpensive tool for code and cloud. Aikido’s SAST uses tuned rules, AI triage of unreachable findings and fix suggestions with confidence levels (Aikido SAST). A free plan covers two users and Basic is $300 a month for 10 (Aikido pricing). Test any all-in-one platform against a specialist on your main language.

AI-native SAST tools and others worth a look

A newer group of tools has a language model read the code, pitched at access control and logic flaws that rules miss. Endor Labs AI SAST runs multiple agents and names IDOR and auth bypass as targets; its pricing is on request. ZeroPath Team starts at $1,000 a month plus $60 per developer, and Corgea charges $39 or $49 per developer a month after a free individual plan. DryRun Security publishes no price. Enterprise shortlists can add Mend SAST (Mend AppSec up to $1,000 per developer a year) and Kiuwan (Professional from $49 per user a month, billed annually). Model output can vary between runs, so put these tools through the same bake-off. AI also writes more of the code these tools scan, which brings its own problems: see the security risks of vibe coding.

The best free and open-source SAST tools

Tool	Language	Strength	License or terms	Watch out for
Semgrep CE	Many	Fast rules that read like code	LGPL-2.1	Single function or file only; its README warns it misses many true positives
Opengrep	Many	Semgrep CE fork backed by Aikido, Endor Labs, Orca Security and others; cross-function taint in a file, cross-file in alpha	LGPL-2.1	Young project
CodeQL	10 families	Deep semantic queries	Proprietary terms, free on open-source code and for research	No PHP or Scala
SonarQube Community Build	20+	Quality, basic vulnerabilities, secrets	Free	No taint or pull request analysis
Bandit	Python	Syntax-tree plugins for common issues	Apache 2.0	No cross-file flow
gosec	Go	Taint analysis for SQL and command injection and SSRF; SARIF output	Apache 2.0	Go only
Brakeman	Rails	Rails-aware injection and XSS detection	Public Use License, free for your own code	Bundling it into a product or offering it as a scanning service needs a commercial license
Find Security Bugs	Java and other JVM languages	SpotBugs plugin, 144 vulnerability types	LGPL	Needs compiled bytecode; JVM languages only
Psalm	PHP	Taint analysis on by default	Open source	Trusts your escaping, so wrong escaping slips through
eslint-plugin-security	JavaScript	ESLint rules for security hotspots	Apache 2.0	Its README warns of many false positives

OWASP keeps a longer, unranked list of source code analysis tools.

Best SAST tool by language

“Deep analysis” means the vendor documents cross-file dataflow for that language. SonarQube entries need Developer Edition or higher.

Language	Deep analysis	Free specialist	Note
Java	CodeQL, Semgrep Code, SonarQube	Find Security Bugs
Python	CodeQL, Semgrep Code, SonarQube	Bandit
JavaScript and TypeScript	CodeQL, Semgrep Code	eslint-plugin-security
PHP	SonarQube	Psalm	No CodeQL support; Semgrep Code is cross-function only
C and C++	Black Duck Coverity, CodeQL, Semgrep Code	CodeQL on public repositories	Coverity for MISRA, AUTOSAR and CERT rules
Go	CodeQL, Semgrep Code	gosec
Ruby	CodeQL	Brakeman (Rails)	Semgrep Code is cross-function only; Snyk Code has no interfile analysis
C#	CodeQL, Semgrep Code, SonarQube	Semgrep CE or Opengrep
Swift and Kotlin (mobile)	CodeQL for both, Semgrep Code for Kotlin	Semgrep CE or Opengrep
Terraform (infrastructure as code)	Semgrep, SonarQube	Semgrep CE or Opengrep

For a Java and Python monorepo, or a Python and JavaScript codebase, CodeQL and Semgrep Code both document cross-file analysis for every language involved (Semgrep languages, checked November 11, 2026).

How to choose a SAST tool

1. Depth for your languages, not the count. Ask which languages get cross-file taint analysis: Semgrep Code lists eight, SonarQube nine, and CodeQL skips PHP. A tool that does not model your framework’s routing sees no sources to trace.
2. Noise on your code. OWASP lists high numbers of false positives as a core SAST weakness. Developers stop reading a noisy tool, so block builds only on high-confidence rules.
3. Where findings appear. IDE, pull request or CI gate, fast enough that people wait for it.
4. Build requirements. Some engines need code that compiles, and binary scanning such as Veracode’s still needs a compiled artifact: it helps when you lack source, not a build. A broken build is a blind spot.
5. Output. SARIF 2.1.0 is an OASIS standard, and GitHub accepts third-party SARIF, so several scanners can feed one triage queue.
6. Data handling. If source cannot leave your network, look at SonarQube Server, Checkmarx, Fortify and Coverity on premises. If a tool uses AI triage or autofix, ask which model provider sees your code and whether you can turn that off.
7. The pricing model, which decides what next year costs:

Model	Who uses it	Count before you sign
Per committer or contributor	GitHub (on Team or Enterprise), Semgrep	Everyone committing to scanned private repos (Semgrep looks back 90 days)
Lines of code	SonarQube	Private lines; the largest branch counts
Flat team plan	Aikido Basic	Users included (10 at $300), scan limits
Starting team price	Snyk Team (up to 10 developers)	Whether the price scales per developer, and monthly test limits
Custom quote	Checkmarx, Veracode, Fortify, Coverity	Developers in scope, applications, modules bundled, SaaS or self-hosted

Run a two-week bake-off before you sign

Vendor benchmarks are written by vendors. Pick two or three repositories in your main languages, including one with security bugs you already fixed: your last penetration test or code review report is the answer key. Add the OWASP Benchmark, a Java and Python test suite designed so that every scored vulnerability is exploitable, as a public baseline.

Measure	How	Good result
Known bugs found	Scan the commit before each fix	Catches the injection and secrets bugs
False positives	A developer triages 50 random findings	Most are real or worth fixing
Pull request speed	Time an incremental scan	Developers wait for it
Fix guidance	Read 10 findings as the code owner	Names the line, the data flow and a fix
Suppressions	Suppress, refactor, rescan	Suppressions survive and leave an audit trail
Cost	Price at your real committer or line count	Still fits next year’s headcount

Secure code review tools beyond SAST

SAST covers the code you wrote. A complete secure code review toolset adds:

• Software composition analysis for vulnerable dependencies, A03 Software Supply Chain Failures in the OWASP Top 10:2025. OWASP Dependency-Check is the long-standing free option.
• Secret scanning. GitHub Secret Protection is a $19 per active committer a month add-on to Team or Enterprise; Gitleaks is free, but its README says it is feature complete, future releases will be security patches only, and its maintainer is moving to a successor project, Betterleaks.
• Infrastructure-as-code checks for Terraform and Kubernetes manifests; Semgrep and SonarQube both cover Terraform. The pipeline itself is an attack path too (CI/CD pipeline security).
• A reviewer. NIST’s Secure Software Development Framework, task PW.7.2, gives as an example a static analysis tool with a human reviewing what it reports (NIST SP 800-218); our secure software development lifecycle guide puts the framework in context. Tool rules should come from your secure coding standards, and building a secure code review program covers where to aim the people.

What SAST tools miss

Broken access control is A01 in the OWASP Top 10:2025, and static analysis is worst at it; OWASP’s tools page says access control and authentication flaws are hard to find automatically. A tool can trace an invoice ID from the request to the query, but not whether the invoice belongs to the caller: an IDOR like this has no rule, because the rule is your business model.

Business logic, tenant isolation, authentication design and chained low-severity findings routinely slip past tools, and runtime configuration is not in the source at all; that is what DAST tools and penetration tests cover. Shifting security left done well means tools early and often, and people where a mistake costs money or data.

What a manual secure code review costs

Our secure code review service uses AI-assisted static analysis to flag candidates, then a senior reviewer confirms or discards every one and reads the code handling identity, money and tenant data by hand. Findings are traced to file and line and mapped to CWE and OWASP ASVS.

Tier	Typical scope	Fixed price
Small	One service or module up to roughly 20,000 lines in one language, or one high-risk feature	$4,800
Medium	A full application of moderate size in one or two languages	$8,900
Large	A large or multi-repository codebase across several languages	$12,000

Every tier includes executive and technical reports, a developer walkthrough call, an attestation letter and the findings platform, and once fixes merge the free re-review reissues the report with those findings closed. Send your current scanner output when you scope, so manual hours skip what the tool already caught and go to authorization and logic. To prove the running application holds up, add a web application penetration test from $5,200 (see web application penetration testing cost). See the secure code review cost guide and a sample report.

Frequently asked questions

What are the top 5 SAST tools? The five that fit the most teams are GitHub CodeQL, Semgrep, SonarQube, Snyk Code and Checkmarx One. That is our view of fit, not a measured ranking.

Is SonarQube a SAST or DAST tool? SAST: it analyzes source code without running it. Testing the running application needs DAST or a penetration test.

What is the best free SAST tool? Semgrep Community Edition or Opengrep for most languages, plus CodeQL for public GitHub repositories and a specialist such as Bandit, gosec or Brakeman for your stack.

Which SAST tool is best for Java? CodeQL, Semgrep Code and SonarQube from Developer Edition all document cross-file taint analysis for Java, and Find Security Bugs is the free option for compiled JVM code.

Which SAST tools scan PHP? SonarQube from Developer Edition runs taint analysis on PHP, GitLab SAST and Semgrep cover it, and Psalm is the free PHP specialist. CodeQL does not support PHP.

Which SAST platforms support the most programming languages? By vendor count, Veracode (100+ languages and frameworks), OpenText Fortify (44+) and SonarQube (35+). Vendors count differently, so ask which of your languages get cross-file analysis.

Does PCI DSS require a SAST tool? Not by name. Requirement 6.2.3 of PCI DSS v4.0.1 requires bespoke and custom software to be reviewed before release, and 6.2.3.1 says manual reviews, where used, need a reviewer who is not the author and knows secure coding, plus management approval before release. Many teams run SAST on every change and a manual review on high-risk releases.

How much do SAST tools cost? Published prices run from free tiers to $30 per committer or contributor a month (Semgrep, and GitHub as an add-on to a Team or Enterprise plan), $34 a month for 100,000 lines on SonarQube Cloud, and $300 a month for 10 users on Aikido. Checkmarx, Veracode, Fortify and Coverity quote. A manual secure code review at Invadel starts at $4,800, fixed.

The short version

Pick the SAST tool that understands your main language deeply and stays quiet enough that developers read it, then prove it on bugs you have already fixed. Put a person on the code that handles identity, money and tenant data with a secure code review (fixed price from $4,800, with a free re-review once fixes merge): scope it here and get your number the same day.