Static application security testing (SAST) reads your source code, without running it, to find security bugs such as injection, hardcoded secrets and weak cryptography. There are good free options. The right one depends on your language, where your code lives and how much tuning you are willing to do. This guide compares them honestly, including the limits of DepWarden's own scanner.
| Tool | Best for | Languages | How you run it |
|---|---|---|---|
| DepWarden | A quick scan with no account or install: paste code, upload a zip or connect a repo | 14 languages plus Terraform, Dockerfile, YAML and secrets, 350 rules | Browser; CI use through an API key on a plan that includes SAST |
| Semgrep Community Edition | Custom rules and fast pattern-based scanning in CI | Many languages | Open-source CLI |
| CodeQL | Deep semantic queries on GitHub-hosted code | C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, GitHub Actions workflows | GitHub code scanning |
| SonarQube Community Build | Code quality and security in one self-hosted dashboard | Many languages | Self-hosted server |
| Bandit | Python-only checks in a build | Python | Open-source CLI |
| Brakeman | Ruby on Rails applications | Ruby (Rails) | Open-source CLI |
| gosec | Go projects | Go | Open-source CLI |
| SpotBugs with Find Security Bugs | Java bytecode analysis | Java | Build plugin |
A free, community-supported code scanner. The engine is under the LGPL 2.1 license, and the community rules are under a separate Semgrep Rules License v1.0 designed for internal business use, which cannot be resold without permission. According to Semgrep's documentation, taint analysis, cross-file and cross-function analysis, dependency scanning and secrets detection are part of its paid products.
GitHub's code analysis engine, which treats code as data: it builds a database from your code and runs queries against it. It supports C/C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows. Availability for private repositories depends on your GitHub plan, so check GitHub's current terms.
A self-hosted server that combines code-quality and security analysis. It is a good fit when you want one dashboard for maintainability and security and you are happy to run the server.
Bandit (Python), Brakeman (Rails), gosec (Go) and SpotBugs with Find Security Bugs (Java) are narrow but precise. If you only write one of these languages, the dedicated tool is often the best first choice, and a broader scanner can add a second opinion.
SAST finds bugs in the code you write. Your dependencies are a separate problem, handled by software composition analysis: see free SCA tools compared and SAST vs SCA. New to the topic? Start with what is SAST.
It depends on your language and workflow. Use a dedicated scanner if you write one language, Semgrep for custom rules, CodeQL on GitHub for deep queries, and a browser scanner such as DepWarden when you want a result immediately without setup.
Yes. SCA looks for known vulnerabilities in the packages you import; SAST looks for vulnerabilities in the code you write. They find different problems.
Every static analyser reports some false positives and misses some real bugs. Treat findings as leads: review them, fix the real ones, and suppress the rest with a written reason. Rules that require untrusted input to reach a dangerous call, as DepWarden's taint-aware rules do, reduce noise.
Open the free SAST scanner, paste some code, and see the findings with the fix for each.