Free SAST scanner — static application security testing online

Static Application Security Testing (SAST) analyzes source code for security vulnerabilities without executing it. DepWarden is a free SAST tool: upload a source zip or run the CLI/GitHub Action, and it scans your code for SQL injection, XSS, hardcoded credentials, weak cryptography, framework misconfigurations, and 350 more vulnerability classes — across 14 languages, with no account.

Languages and file types supported

DepWarden's SAST engine covers:

Coverage depth is not uniform, and it matters more than the language list: JavaScript/TypeScript, Python and Java are the deepest, followed by PHP, Go, Ruby and C#. Kotlin, Swift, Shell, Terraform/HCL, YAML, CloudFormation and Dockerfile have focused rule sets aimed at the highest-severity classes for those ecosystems. C, C++ and Rust are currently thin — a handful of memory-safety and injection rules each, not comparable to the languages above. Scala has no rule set yet. Every rule in the catalogue is browsable in-app with its exact pattern, severity and a fix example, and the rule list shows the live per-language count — so you can confirm the depth for *your* stack before relying on it, rather than taking this page's word for it. Languages are selectable directly in the paste-code flow and auto-detected by file extension for zip uploads and connected-repo scans.

What it detects

Injection vulnerabilities (CWE-89, CWE-78, CWE-79): SQL injection, NoSQL injection, OS command injection, LDAP injection, and Cross-Site Scripting — using intra-file taint analysis that confirms user-controlled data reaches the dangerous sink before firing, keeping false positives low.

Hardcoded credentials (CWE-798): AWS/GCP/Azure keys, GitHub tokens, Stripe live keys, private RSA/EC keys, JWT secrets, database connection strings with embedded passwords — across source files, IaC, and config files, with redacted previews in findings so credentials are never echoed back.

Weak cryptography (CWE-327, CWE-326): MD5 or SHA-1 used for password hashing, DES or RC4 usage, ECB mode encryption, hardcoded initialization vectors, 1024-bit RSA keys, old TLS versions, Math.random() for security tokens.

Insecure configuration: Django DEBUG = True, CSRF protection disabled, CORS wildcard origins, Spring Actuator fully exposed, Kubernetes privileged containers, Dockerfile running as root, GitHub Actions script injection.

Framework-specific rules: Django, Spring Boot, Express/Node.js, Ruby on Rails, Laravel, ASP.NET Core — each with framework-idiomatic patterns for CSRF bypass, mass assignment, unsafe redirects, SQL string interpolation, and more.

API and web security: JWT none algorithm, JWT decoded without signature verification, SSRF via user-controlled URL, open redirect, GraphQL introspection in production, API keys in URL parameters, timing-attack-vulnerable token comparison.

Mobile: Android WebView JavaScript enabled, external storage for sensitive data, iOS NSLog with sensitive data, weak keychain accessibility, SSL pinning bypass patterns.

How the engine works

DepWarden uses a three-tier analysis approach:

Pattern matching covers the broadest surface: regular expressions targeting known-dangerous function calls, configuration values, and code patterns across all 14 languages. Fast, high recall.

AST analysis (via tree-sitter) parses supported languages into a syntax tree and finds structural patterns that regex can't express cleanly — method call chains, argument shapes, class inheritance patterns.

Taint analysis tracks data flow from untrusted sources (HTTP parameters, form inputs, process.argv, request.GET) to dangerous sinks (SQL queries, shell commands, HTML output). Injection-class rules only fire when the taint path is confirmed, which is why DepWarden's SQLi/XSS/command-injection rules produce far fewer false positives than pure pattern-matching scanners.

Running SAST

Upload a source zip in the browser and DepWarden scans it in a private, session-isolated workspace — no account, no install. You can also connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch directly for a one-off or scheduled scan.

Suppress a known safe finding:

// depwarden-ignore: eval-user-input — content is from signed config, not user input
eval(configExpression);

SAST vs SCA: why you need both

SAST finds security bugs in the code your team writes. SCA finds vulnerabilities in the open-source packages you import. Their blind spots are almost perfectly complementary:

FindingSASTSCA
SQL injection in your code✓✗
XSS in your templates✓✗
Hardcoded API key in source✓✗
CVE in lodash@4.17.4✗✓
Typosquat: expresss vs express✗✓
Unmaintained / EOL package✗✓

DepWarden runs both in one tool, one GitHub Action, no account.

Related: software composition analysis · free vulnerability scanner · SAST vs SCA guide · free SBOM scanner.

SAST by language

The rule catalog has 350 rules. Pick your language for what is checked, real examples and how to run it:

Not sure which SAST tool to use? See free SAST tools compared.