Best GitHub CodeQL Alternatives in 2026
Taken from SAST Tools, where GitHub CodeQL is listed too, in the same order.
- 1
8.7 Club scoreSemgrep Code
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers address them.
- Free plan
- Open source
- Windows · macOS · Linux · Web
- 2 8.0 Club score
MobSF
MobSF is a mobile application security research platform for penetration testing, malware analysis, and privacy analysis.
- Free plan
- Windows · macOS · Linux · Web
- 3
7.7 Club scoreKiuwan Code Security
Kiuwan Code Security is a static application security testing tool for finding and prioritizing source-code vulnerabilities and guiding remediation before production.
- Free trial
- Windows · macOS · Linux · Web
- 4
7.6 Club scoreFlawfinder
Flawfinder examines C and C++ source code for possible security weaknesses and sorts reported hits by risk.
- Free plan
- Windows · macOS · Linux · Self-hosted
- 5
7.6 Club scorePVS-Studio
PVS-Studio analyzes source code to detect bugs and potential vulnerabilities.
- Free plan
- Windows · macOS · Linux
- 6 7.5 Club score
NodeJsScan
NodeJsScan is a static application security testing scanner for Node.js applications.
- Free plan
- macOS · Linux · Web · API
- 7
7.4 Club scoreFluid Attacks
Fluid Attacks is an application security platform for finding, reporting, managing, and remediating vulnerabilities across the software development lifecycle.
- Free trial
- Windows · macOS · Linux · Web
- 8
7.4 Club scoreNaiveSystems Analyze
NaiveSystems Analyze is a static analysis tool for finding security problems in source code and checking functional-safety and coding-standard compliance.
- Free plan
- Windows · macOS · Linux · Self-hosted
- 9
7.4 Club scoreCodeSonar
CodeSonar is a static application security testing product for finding security and quality defects in source code and compiled binaries.
- Free trial
- Windows · Linux · Web · Self-hosted
- 10
7.4 Club scoreJoern
Joern is a free, open-source platform for analyzing source code, bytecode, and binary code during vulnerability discovery and static program analysis research.
- Free plan
- Windows · macOS · Linux · API
- 11
7.4 Club scoreQwiet AI
Qwiet AI is part of the Harness platform and scans source code and dependencies for application security vulnerabilities.
- Windows · macOS · Linux · Web
- 12 7.2 Club score
Security Code Scan
Security Code Scan is a free, open-source static analyzer for .NET source code in C# and VB.NET.
- Free plan
- Windows · Linux · Self-hosted
- 13
7.2 Club scoreZeroPath
ZeroPath is an AI-native application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
- Windows · macOS · Linux · Web
- 14 7.2 Club score
Bandit
Bandit is a free security linter for Python source code.
- Free plan
- macOS · Linux · Self-hosted
- 15 7.0 Club score
gosec
gosec is a free security checker that scans Go source code for potential security issues.
- Free plan
- macOS · Linux · Self-hosted
- 16 7.0 Club score
Brakeman
Brakeman is a static analysis scanner for Ruby on Rails application source code.
- Free plan
- Linux · Self-hosted
- 17
6.8 Club scoreBearer
Bearer CLI is a static application security testing tool for scanning source code and tracing data flows to identify security and privacy risks.
- Free plan
- macOS · Linux
- 18
6.8 Club scoreBlack Duck Coverity
Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects before software ships.
- Windows · macOS · Linux · Web
- 19
6.7 Club scoreDerScanner
DerScanner is an application-security platform that combines static, dynamic, software-composition, and mobile testing.
- Windows · Linux · Web · API
- 20 6.5 Club score
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned APIs.
- Web · API · Self-hosted