- Home
- Static Application Security Testing Software
- Microsoft DevSkim
Microsoft DevSkim
What it is
Microsoft DevSkim is a free toolkit for security linting and static source-code analysis. It includes IDE plugins, language analyzers, and built-in rules to help developers identify security issues early; teams can also create custom rules using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as binaries for Windows, macOS, and Linux. A C# library is available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text. The CLI can apply suggested fixes from SARIF results and add suppression comments. The repository lists extensions for Visual Studio Code and Visual Studio, and DevSkim supports self-hosted deployment and CI/CD. It is licensed under the MIT License. Project support is limited to GitHub issues and wiki resources; vulnerability reports should be sent privately to Microsoft's Security Response Center instead of posted in public GitHub issues.
For and against
For
- Free and licensed under the MIT License.
- CLI analyzes files and directories across Windows, macOS, and Linux.
- Supports SARIF, JSON, and text output.
- CLI can apply suggested fixes and add suppressions.
Against
- Support is limited to GitHub issues and project wiki resources.
- Security reports should be sent privately, not posted in public issues.
The verdict
DevSkim offers source analysis through IDE extensions, a CLI, and an embeddable C# library. Its suggested fixes and suppression comments can help address findings, while support channels are limited.
Who it suits
DevSkim suits developers who want security analysis in an IDE, command-line workflow, or other tool. Its rules and language support cover a range of source code, with custom rules available for additional checks.
Plans and prices
DevSkim
MIT-licensed open-source library, CLI, and IDE extensions
Read 12 Oct 2026 · github.com
On the record
- CLI
- The cross-platform .NET CLI analyzes files and directories and can be installed as a .NET global tool or downloaded as platform-specific binaries for Windows, macOS, and Linux.github.com · read 12 Oct 2026
- Fixes and suppressions
- The CLI can apply suggested fixes from SARIF results and add suppression comments for reported issues.github.com · read 12 Oct 2026
- IDE integrations
- The repository lists DevSkim extensions for Visual Studio Code and Visual Studio.github.com · read 12 Oct 2026
- Intended users
- The project describes its goal as helping developers identify and fix security vulnerabilities early and build security awareness.github.com · read 12 Oct 2026
- Languages
- Its listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others.github.com · read 12 Oct 2026
- Library
- A C# library is available for embedding DevSkim analysis in other tools, with the package published on NuGet.github.com · read 12 Oct 2026
- License
- DevSkim is licensed under the MIT License.github.com · read 12 Oct 2026
- Output formats
- The tool supports SARIF, JSON, and text output formats.github.com · read 12 Oct 2026
- Purpose
- DevSkim provides IDE plugins, language analyzers, and rules for security linting and static source-code analysis.github.com · read 12 Oct 2026
- Rule formats
- Rules can use JSONPath, XPath, and YmlPath.github.com · read 12 Oct 2026
- Rules
- It includes built-in rules and supports writing custom rules.github.com · read 12 Oct 2026
- Security reporting
- The project asks users to report vulnerabilities privately to Microsoft's Security Response Center rather than through public GitHub issues.github.com · read 12 Oct 2026
- Support
- Support is limited to GitHub issues and the project wiki resources listed in its support policy.github.com · read 12 Oct 2026
