- Home
- SAST Tools
- Security Code Scan
Security Code Scan
What it is
Security Code Scan is a free, open-source static analyzer for .NET projects written in C# and VB.NET. It searches source code for vulnerability patterns including SQL injection, cross-site scripting, CSRF, and XML external entity injection. Inter-procedural taint analysis follows input data across code. Projects can be analyzed in the background through IntelliSense or during a build. GitHub and GitLab pipeline support, MSBuild, and a stand-alone runner support automated workflows and custom integrations. Custom integrations can output SARIF results and place warnings beside other build messages. Users can configure taint sources, sinks, sanitizers, validators, and project settings. Releases include a NuGet package, Visual Studio extension, and stand-alone runner. Visual Studio 2019 or later is supported, with other Roslyn editors expected to work. It runs on Windows, Linux, and self-hosted setups.
For and against
For
- Free and open source
- Finds several common vulnerability patterns
- Supports GitHub and GitLab pipelines
- Custom taint rules and settings
- Produces SARIF for integrations
Against
- IDE or NuGet use can slow analysis
- Automated fixes are not included
- Audit mode is off by default
The verdict
Security Code Scan focuses on static security analysis for C# and VB.NET, with editor, build, and pipeline use. Its configurable taint analysis and integration outputs are useful when findings need to fit existing development workflows.
Who it suits
It suits .NET developers and teams that want vulnerability analysis during coding or CI/CD. Custom rules and pipeline options help organizations with project-specific security checks.
Plans and prices
Security Code Scan
Open source static analyzer for .NET
Read 9 Oct 2026 · security-code-scan.github.io
On the record
- CI recommendation
- The maker says CI/CD is the more common use case and recommends pipeline integrations for that use.security-code-scan.github.io · read 9 Oct 2026
- Customization
- Users can configure custom taint sources, sinks, sanitizers, validators, and project-specific settings.security-code-scan.github.io · read 9 Oct 2026
- Detection
- It detects patterns including SQL injection, cross-site scripting, CSRF, and XML external entity injection.security-code-scan.github.io · read 9 Oct 2026
- Downloads
- Official releases are offered as a NuGet package, a Visual Studio extension, and a stand-alone runner.github.com · read 9 Oct 2026
- Editors
- It supports Visual Studio 2019 or higher and says other Roslyn analyzer editors such as Rider or OmniSharp should work.security-code-scan.github.io · read 9 Oct 2026
- Integrations
- The site lists GitHub and GitLab pipeline support, plus MSBuild and a stand-alone runner for custom integrations.security-code-scan.github.io · read 9 Oct 2026
- License
- The project repository identifies its license as LGPL-3.0.github.com · read 9 Oct 2026
- Limitations
- Audit mode is off by default and can produce more warnings about data with unknown taint state when enabled.security-code-scan.github.io · read 9 Oct 2026
- Performance
- The maker warns that installing it as a Visual Studio extension or NuGet package can slow the IDE because it performs extensive static analysis.security-code-scan.github.io · read 9 Oct 2026
- Purpose
- Security Code Scan is a static code analyzer for .NET that detects vulnerability patterns in C# and VB.NET.security-code-scan.github.io · read 9 Oct 2026
- Results
- For custom integrations, it can produce SARIF results and show warnings alongside other build messages.security-code-scan.github.io · read 9 Oct 2026
- Support
- The maker provides a troubleshooting guide and directs users to project issues and contributions on GitHub.github.com · read 9 Oct 2026
- Taint analysis
- The analyzer performs inter-procedural taint analysis for input data.security-code-scan.github.io · read 9 Oct 2026
- Usage
- It analyzes projects in the background as IntelliSense or during a build.security-code-scan.github.io · read 9 Oct 2026
