Free SAST tools compared: which static analysis tool should you use?

Static application security testing (SAST) reads your source code, without running it, to find security bugs such as injection, hardcoded secrets and weak cryptography. There are good free options. The right one depends on your language, where your code lives and how much tuning you are willing to do. This guide compares them honestly, including the limits of DepWarden's own scanner.

The free SAST tools at a glance

ToolBest forLanguagesHow you run it
DepWardenA quick scan with no account or install: paste code, upload a zip or connect a repo14 languages plus Terraform, Dockerfile, YAML and secrets, 350 rulesBrowser; CI use through an API key on a plan that includes SAST
Semgrep Community EditionCustom rules and fast pattern-based scanning in CIMany languagesOpen-source CLI
CodeQLDeep semantic queries on GitHub-hosted codeC/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, GitHub Actions workflowsGitHub code scanning
SonarQube Community BuildCode quality and security in one self-hosted dashboardMany languagesSelf-hosted server
BanditPython-only checks in a buildPythonOpen-source CLI
BrakemanRuby on Rails applicationsRuby (Rails)Open-source CLI
gosecGo projectsGoOpen-source CLI
SpotBugs with Find Security BugsJava bytecode analysisJavaBuild plugin

What to know about each

DepWarden

Semgrep Community Edition

A free, community-supported code scanner. The engine is under the LGPL 2.1 license, and the community rules are under a separate Semgrep Rules License v1.0 designed for internal business use, which cannot be resold without permission. According to Semgrep's documentation, taint analysis, cross-file and cross-function analysis, dependency scanning and secrets detection are part of its paid products.

CodeQL

GitHub's code analysis engine, which treats code as data: it builds a database from your code and runs queries against it. It supports C/C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows. Availability for private repositories depends on your GitHub plan, so check GitHub's current terms.

SonarQube Community Build

A self-hosted server that combines code-quality and security analysis. It is a good fit when you want one dashboard for maintainability and security and you are happy to run the server.

Language-specific scanners

Bandit (Python), Brakeman (Rails), gosec (Go) and SpotBugs with Find Security Bugs (Java) are narrow but precise. If you only write one of these languages, the dedicated tool is often the best first choice, and a broader scanner can add a second opinion.

How to choose

SAST is only half of it

SAST finds bugs in the code you write. Your dependencies are a separate problem, handled by software composition analysis: see free SCA tools compared and SAST vs SCA. New to the topic? Start with what is SAST.

Frequently asked questions

What is the best free SAST tool?

It depends on your language and workflow. Use a dedicated scanner if you write one language, Semgrep for custom rules, CodeQL on GitHub for deep queries, and a browser scanner such as DepWarden when you want a result immediately without setup.

Do I need SAST if I already run SCA?

Yes. SCA looks for known vulnerabilities in the packages you import; SAST looks for vulnerabilities in the code you write. They find different problems.

Are free SAST tools accurate?

Every static analyser reports some false positives and misses some real bugs. Treat findings as leads: review them, fix the real ones, and suppress the rest with a written reason. Rules that require untrusted input to reach a dangerous call, as DepWarden's taint-aware rules do, reduce noise.

Try it

Open the free SAST scanner, paste some code, and see the findings with the fix for each.