Best SAST Tools in 2026
Updated
In short: Semgrep Code is ranked #1 of 25 as of 4 October 2026, ahead of Snyk Open Source and Flawfinder. The best-ranked option with a free plan is Snyk Open Source. The lowest first paid tier on this page is Kiuwan Code Security at $4.08/mo.
Reviewing code for security issues calls for attention to both coverage and development workflow. These ranked SAST tools are compared on analysis targets and supported languages, alongside IDE support, CI/CD integration, and pull request scans. Automated fixes and custom security rules offer additional distinctions, while free-plan availability and paid-from pricing provide cost context. Semgrep Code leads the entries, followed by Snyk Open Source and PVS-Studio; Bandit and Bearer are also among the first options. Consider the code and workflows you need to cover, then compare the listed language, integration, and analysis capabilities.
25 SAST tools ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 1 Semgrep Code No phone app RecognisedPhone appDocumentedFree plan 6.4$30/mo Analysis targets: source codeLanguages supported: 35Pull request scans: Yes
- 2 Snyk Open Source No phone app RecognisedPhone appDocumentedFree plan 6.4$25/mo Analysis targets: source codeLanguages supported: 16Pull request scans: Yes
- 3 Flawfinder No phone app RecognisedPhone appDocumentedFree plan 6.3Free Analysis targets: source code
- 4 PVS-Studio No phone app RecognisedPhone appDocumentedFree plan 5.8 Analysis targets: source codePull request scans: Yes
- 5 Veracode DAST No phone app RecognisedPhone appDocumentedFree plan 5.8 Analysis targets: source code, bytecode, binariesPull request scans: Yes
- 6 Black Duck Coverity No phone app RecognisedPhone appDocumentedFree plan 5.7 Analysis targets: source codePull request scans: Yes
- 7 Checkmarx API Security No phone app RecognisedPhone appDocumentedFree plan 5.6 Analysis targets: source codePull request scans: Yes
- 8 ZeroPath No phone app RecognisedPhone appDocumentedFree plan 5.5$1,000/mo Analysis targets: source codePull request scans: Yes
- 9 CodeSonar No phone app RecognisedPhone appDocumentedFree plan 5.4 Analysis targets: source code, binariesPull request scans: Yes
- 10 Klocwork No phone app RecognisedPhone appDocumentedFree plan 5.4 Analysis targets: source codePull request scans: Yes
- 11 OpenText Fortify SAST No phone app RecognisedPhone appDocumentedFree plan 5.4 Analysis targets: source code, bytecode, binariesPull request scans: Yes
- 12 Bandit No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source code
- 13 Bearer No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source codePull request scans: Yes
- 14 DerScanner No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source code, bytecode, binaries
- 15 gosec No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source codePull request scans: Yes
- 16 MobSF No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source code, binariesPull request scans: Yes
- 17 NaiveSystems Analyze No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source code
- 18 NodeJsScan No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source codePull request scans: Yes
- 19 Security Code Scan No phone app RecognisedPhone appDocumentedFree plan 5.3 Analysis targets: source code
- 20 Brakeman No phone app RecognisedPhone appDocumentedFree plan 5.2 Analysis targets: source code
- 21 Fluid Attacks No phone app RecognisedPhone appDocumentedFree plan 5.2 Analysis targets: source codeLanguages supported: 14Pull request scans: Yes
- 22 Joern No phone app RecognisedPhone appDocumentedFree plan 5.2 Analysis targets: source code, bytecode, binaries
- 23 Kiuwan Code Security No phone app RecognisedPhone appDocumentedFree plan 5.2$4.08/mo Analysis targets: source codePull request scans: Yes
- 24 Qwiet AI No phone app RecognisedPhone appDocumentedFree plan 5.1 Analysis targets: source code and dependencies
- 25 HCL AppScan Source No phone app RecognisedPhone appDocumentedFree plan 5.0 Analysis targets: source code
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which SAST tool is ranked first on Samsung Mobile US Press?
Semgrep Code is ranked #1 of 25 with a score of 6.4. Snyk Open Source is second and Flawfinder third.
How many of these have a free plan?
3 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Kiuwan Code Security has the lowest first paid tier we found: $4.08/mo.
How is this list ranked?
Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation. Paid placements never change a rank.