Free SAST tools compared: which static analysis tool should you use?
Static application security testing (SAST) reads your source code, without running it, to find security bugs such as injection, hardcoded secrets and weak cryptography. There are good free options. The right one depends on your language, where your code lives and how much tuning you are willing to do. This guide compares them honestly, including the limits of DepWarden's own scanner.
The free SAST tools at a glance
| Tool | Best for | Languages | How you run it |
|---|---|---|---|
| DepWarden | A quick scan with no account or install: paste code, upload a zip or connect a repo | 14 languages plus Terraform, Dockerfile, YAML and secrets, 350 rules | Browser; CI use through an API key on a plan that includes SAST |
| Semgrep Community Edition | Custom rules and fast pattern-based scanning in CI | Many languages | Open-source CLI |
| CodeQL | Deep semantic queries on GitHub-hosted code | C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, GitHub Actions workflows | GitHub code scanning |
| SonarQube Community Build | Code quality and security in one self-hosted dashboard | Many languages | Self-hosted server |
| Bandit | Python-only checks in a build | Python | Open-source CLI |
| Brakeman | Ruby on Rails applications | Ruby (Rails) | Open-source CLI |
| gosec | Go projects | Go | Open-source CLI |
| SpotBugs with Find Security Bugs | Java bytecode analysis | Java | Build plugin |
What to know about each
DepWarden
- Strengths: free in the browser with no account. 350 rules across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, C#, Kotlin, Swift, Shell, C, C++ and Rust, plus Terraform, Dockerfile and YAML infrastructure rules, and 33 secret and credential rules. Every rule carries a CWE and, where it applies, an OWASP Top 10 category, with a fix and a before-and-after example.
- Limits: it uses pattern rules and taint-aware rules that require untrusted input to reach a dangerous call. It is not a full cross-file dataflow engine, so a bug that only shows up when data crosses several files can be missed. Coverage is deep for JavaScript, TypeScript, Python and Java, and shallow for C, C++ and Rust. Running it from CI through an API key needs a plan that includes SAST.
- Language pages: Python, Java, JavaScript and TypeScript, PHP, Go (Golang), C#, Ruby, Kotlin, Swift and secret scanning.
Semgrep Community Edition
A free, community-supported code scanner. The engine is under the LGPL 2.1 license, and the community rules are under a separate Semgrep Rules License v1.0 designed for internal business use, which cannot be resold without permission. According to Semgrep's documentation, taint analysis, cross-file and cross-function analysis, dependency scanning and secrets detection are part of its paid products.
CodeQL
GitHub's code analysis engine, which treats code as data: it builds a database from your code and runs queries against it. It supports C/C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows. Availability for private repositories depends on your GitHub plan, so check GitHub's current terms.
SonarQube Community Build
A self-hosted server that combines code-quality and security analysis. It is a good fit when you want one dashboard for maintainability and security and you are happy to run the server.
Language-specific scanners
Bandit (Python), Brakeman (Rails), gosec (Go) and SpotBugs with Find Security Bugs (Java) are narrow but precise. If you only write one of these languages, the dedicated tool is often the best first choice, and a broader scanner can add a second opinion.
How to choose
- A result in a minute with nothing to install: paste code into DepWarden.
- Custom rules for your own patterns: Semgrep.
- Deep dataflow queries on GitHub: CodeQL.
- One language, deep coverage in your build: the language-specific tool.
- A dashboard for a whole organisation: SonarQube.
SAST is only half of it
SAST finds bugs in the code you write. Your dependencies are a separate problem, handled by software composition analysis: see free SCA tools compared and SAST vs SCA. New to the topic? Start with what is SAST.
Frequently asked questions
What is the best free SAST tool?
It depends on your language and workflow. Use a dedicated scanner if you write one language, Semgrep for custom rules, CodeQL on GitHub for deep queries, and a browser scanner such as DepWarden when you want a result immediately without setup.
Do I need SAST if I already run SCA?
Yes. SCA looks for known vulnerabilities in the packages you import; SAST looks for vulnerabilities in the code you write. They find different problems.
Are free SAST tools accurate?
Every static analyser reports some false positives and misses some real bugs. Treat findings as leads: review them, fix the real ones, and suppress the rest with a written reason. Rules that require untrusted input to reach a dangerous call, as DepWarden's taint-aware rules do, reduce noise.
Try it
Open the free SAST scanner, paste some code, and see the findings with the fix for each.