Top 403 static-analysis open source projects

A Ruby code quality reporter

Quality Police for Java projects

Automatically generates FORtran Documentation from comments within the code.

An open source script to perform malware static analysis on Portable Executable

PHPUnit extensions and rules for PHPStan

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.

Jenkins Warnings Plugin - Next Generation

[LLVM Static Slicer] Various program analyses, construction of dependence graphs and program slicing of LLVM bitcode.

The modern Java bytecode editor

Detect uses of legacy Java APIs

Inline syscalls made easy for windows on clang

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

A PHP parser written in PHP

A set of utilities for checking Go sources. This repository has migrated to https://gitlab.com/opennota/check

The CodeQL extractor and libraries for Go.

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

Swiss-army knife for D source code

A plug-in for Google's Protocol Buffers (protobufs) compiler to lint .proto files for style violations.

Security scanner for your Terraform code

A reviewed list of useful PHP static analysis tools

Bolt is a language with in-built data-race freedom!

LibScout: Third-party library detector for Java/Android apps

Policeman's Forbidden API Checker

Awesome Java Security Resources 🕶☕🔐

Intellisense for PHP

Python script to detect vulnerabilities inside PHP source code using static analysis, based on regex

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Custom Python linting through AST expressions

Strict coding standard for Kotlin and a custom set of rules for detecting code smells, code style issues and bugs

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.

✊ Detect non-inclusive language in your source code.

Code Climate CLI

Code metrics for Java code by means of static analysis

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). 🌈

Program for determining types of files for Windows, Linux and MacOS.

Analyzer: checks whether HTTP response body is closed and a re-use of TCP connection is not blocked.

Find similar functions and classes in your JavaScript/TypeScript code

[DEPRECATED] Security Scanner for Ethereum Smart Contracts

an advanced semantic indexer for Ruby

Datalog compiler in Rust as a procedural macro

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

A static analyzer for Java, C, C++, and Objective-C

Java Code Static Metrics (Cohesion, Coupling, etc.)

This repo aims at providing practical examples on how to use r2frida

Moved to Polymer/tools monorepo

PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

Static code analysis for CFML (a linter)

Scanning APK file for URIs, endpoints & secrets.

Manage localization with static analysis. 🔍

Parser for Angular projects.

The leading static analyzer for Perl. Configurable, extensible, powerful.

TypeScript Compiler API wrapper for static analysis and programmatic code changes.

Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code

Gradle plugin for PIT Mutation Testing

Static Analyzer for LLVM bitcode based on Abstract Interpretation

Soot - A Java optimization framework

A Psalm plugin for Laravel

GCC plugin that embeds CPython inside the compiler