489 Open source projects that are alternatives of or similar to Semgrep

⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more.

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

A static type analyzer for Python code

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

Code Climate engine for code duplication analysis

PHP Static Analysis Tool - discover bugs in your code without running it!

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

INTERCEPT / Policy as Code Static Analysis Auditing / SAST

⚙️ Scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects at GitHub with Qodana

Static analysis framework for .NET programs.

The official GitHub mirror of https://gitlab.com/pycqa/flake8

🐘 SonarPHP: PHP static analyzer for SonarQube & SonarLint

A linter, formatter for finding and removing unused import statements.

A Static Code Analyzer for PHP (a PhpStorm/Idea Plugin)

Static code analysis for CFML (a linter)

PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.

Policeman's Forbidden API Checker

Standalone linter for ABAP

Lint all your JavaScript, CSS, HTML, Markdown and Dockerfiles with a single command

Automatic test case generation for python and static analysis library

unimport is a Go static analysis tool to find unnecessary import aliases.

Nette Framework class reflection extension for PHPStan & framework-specific rules

OpenStaticAnalyzer is a source code analyzer tool, which can perform deep static analysis of the source code of complex systems.

A library to read static analysis reports into a Java object model

Code Climate Engine for ESLint

cfmt is a tool to wrap Go comments over a certain length to a new line.

☕️ SonarSource Static Analyzer for Java Code Quality and Security

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.

It's not just a linter that annoys you!

A linter, formatter for finding and removing unused import statements.

🐞 Primitive Erlang Security Tool

An extensible multilanguage static code analyzer.

SonarSource Static Analyzer for JavaScript and TypeScript

The leading static analyzer for Perl. Configurable, extensible, powerful.

Manage translation and localization with static analysis, for Ruby i18n

A static analyzer for Java, C, C++, and Objective-C

nodejsscan is a static security code scanner for Node.js applications.

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

Code Climate CLI

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

scalastyle

Duplicate code finder for Elixir

A linter to prevent exception handling antipatterns in Python (limited only for those who like dinosaurs).

Chronos - A static race detector for the go language

PHPUnit extensions and rules for PHPStan

PHPStan extension for webmozart/assert

SonarLint integration for Apache Netbeans

GitHub Action to set up Fortify ScanCentral Client

Jenkins Warnings Plugin - Next Generation

EBA is a static bug finder for C.

nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.

Code Climate Engine for PHP Code Sniffer

identypo is a Go static analysis tool to find typos in identifiers (functions, function calls, variables, constants, type declarations, packages, labels).

Next-gen phpDoc parser with support for intersection types and generics

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

[LLVM Static Slicer] Various program analyses, construction of dependence graphs and program slicing of LLVM bitcode.

Go Taint CHeck Analyser

A plugin to simplify Static Code Analysis on Gradle. Not restricted to, but specially useful, in Android projects, by making sure all analysis can access the SDK classes.

Extra strict and opinionated rules for PHPStan