911 Open source projects that are alternatives of or similar to Gosec

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

Performing security tests inside your CI

a tool to analyze filesystem images for security

Code Climate engine for code duplication analysis

Kubernetes RBAC static Analysis & visualisation tool

Duplicate code finder for Elixir

PHPStan extension for webmozart/assert

Code Climate Engine for ESLint

A plugin to simplify Static Code Analysis on Gradle. Not restricted to, but specially useful, in Android projects, by making sure all analysis can access the SDK classes.

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

An extensible multilanguage static code analyzer.

prealloc is a Go static analysis tool to find slice declarations that could potentially be preallocated.

PHPUnit extensions and rules for PHPStan

A linter to prevent exception handling antipatterns in Python (limited only for those who like dinosaurs).

SonarLint integration for Apache Netbeans

Lint all your JavaScript, CSS, HTML, Markdown and Dockerfiles with a single command

A library to read static analysis reports into a Java object model

OpenStaticAnalyzer is a source code analyzer tool, which can perform deep static analysis of the source code of complex systems.

A linter, formatter for finding and removing unused import statements.

Go Taint CHeck Analyser

Web Scan Lazy Tools - Python Package

Extra strict and opinionated rules for PHPStan

Awesome .NET Security Resources

A static type analyzer for Python code

WEB SERVICE SECURITY ASSESSMENT TOOL

Secure, Unified, Powerful and Extensible Rust Android Analyzer

T.J. Watson Libraries for Analysis

Jenkins Warnings Plugin - Next Generation

[LLVM Static Slicer] Various program analyses, construction of dependence graphs and program slicing of LLVM bitcode.

Droidefense: Advance Android Malware Analysis Framework

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

Nette Framework class reflection extension for PHPStan & framework-specific rules

Automatic test case generation for python and static analysis library

unimport is a Go static analysis tool to find unnecessary import aliases.

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

EBA is a static bug finder for C.

nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.

Code Climate Engine for PHP Code Sniffer

identypo is a Go static analysis tool to find typos in identifiers (functions, function calls, variables, constants, type declarations, packages, labels).

⚙️ Scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects at GitHub with Qodana

Static analysis framework for .NET programs.

Plugin to block compilation when unapproved dependencies are used or code styling does not comply.

🐘 SonarPHP: PHP static analyzer for SonarQube & SonarLint

secureCodeBox (SCB) - continuous secure delivery out of the box

Bandit is a tool designed to find common security issues in Python code.

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

Security Orchestration, Automation and Response (SOAR) Platform. 安全编排与自动化响应平台，无需编写代码的安全自动化，使用 SOAR 可以让团队工作更加高效

It's not just a linter that annoys you!

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

Chronos - A static race detector for the go language

Symfony extension for PHPStan

🔎 shodansploit > v1.3.0

Web application vulnerability scanner

Doctrine extensions for PHPStan

Awesome Java Security Resources 🕶☕🔐

Policeman's Forbidden API Checker

YARA malware query accelerator (web frontend)

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.