What Is Code Quality / SAST / DAST Software?

Mix (22 tools)

• License: 15 open source · 7 proprietary
• Hosting: 15 self-hosted · 5 SaaS · 2 both

Code quality and application security testing tools analyze source code, binaries, and running applications to find bugs, vulnerabilities, code smells, and compliance issues. This category spans several overlapping disciplines:

• Static Application Security Testing (SAST) – analyzes source code or bytecode without executing it; finds vulnerabilities like SQL injection, XSS, buffer overflows, and insecure cryptography at development time
• Dynamic Application Security Testing (DAST) – tests running applications by sending crafted requests and analyzing responses; finds runtime vulnerabilities that SAST cannot detect
• Software Composition Analysis (SCA) – scans project dependencies (libraries, frameworks, container images) for known CVEs and license compliance issues
• Code linting – enforces coding style, formatting rules, and language-specific best practices; catches common programming errors before they become bugs
• Code coverage – measures how much of the codebase is exercised by automated tests; identifies untested code paths
• Vulnerability scanning – broader category covering container images, infrastructure-as-code templates, and cloud configurations for security misconfigurations
• Dependency management – automates dependency updates and monitors for newly disclosed vulnerabilities in project dependencies

Unlike general-purpose CI/CD tools, code quality and security testing tools focus specifically on the analysis and improvement of code and application security posture.

Comparison

Category Matrix

* = Semgrep SCA requires commercial license ** = Nuclei is template-based vulnerability scanning, not traditional DAST *** = Noir maps the attack surface (endpoint discovery) from source; not a vulnerability SAST and does no DAST – it feeds ZAP/Burp

Language Support

Noir detects endpoints across 261 web frameworks in these languages; it does not perform language-level vulnerability analysis.

Deployment Comparison

* = SonarCloud (SaaS) ** = Semgrep Cloud Platform dashboard is SaaS-only; OSS engine is CLI *** = CodeClimate analysis engine (Docker CLI) **** = ProjectDiscovery Cloud (commercial)

Licensing Comparison

SSO / OIDC Comparison

OIDC is the preferred SSO protocol.

* = requires paid/enterprise tier ? = not prominently documented

Best SSO support: Checkmarx, Fortify, Coverity, and GitLab offer full OIDC/SAML/LDAP support. SonarQube Community Edition is limited to LDAP. CLI tools (gosec, Bandit, ESLint, Trivy, ZAP, Nuclei) do not require SSO.

Go Support Detail

This table compares Go-specific capabilities.

Best for Go SAST: gosec (purpose-built) + Semgrep (pattern-based with custom rules) is the recommended combination.

Best for Go SCA: Trivy (free, comprehensive) or Snyk (commercial, curated database).

Best for Go dependency updates: Renovate (most configurable) or Dependabot (simplest on GitHub).

CI/CD Integration Comparison

Tools

22 tools.

AgentGG

AgentGG is an open-source agentic SAST scanner whose AI agents read code and follow its call graph to reason about vulnerabilities, confirming each finding before reporting it.

License: Apache-2.0 (OSS) · Kind: web · Deploy: package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Bandit

Bandit is a Python-specific static analysis tool designed to find common security issues in Python code.

License: Apache-2.0 (OSS) · Kind: web · Deploy: package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Checkmarx

Checkmarx is a leading enterprise application security testing (AST) platform. The flagship product, Checkmarx One, is a cloud-native platform combining SAST, SCA, DAST, API security, supply chain security, and IaC scanning in a unified das…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on · Directory / LDAP

Website

CodeClimate Quality

CodeClimate Quality is a code analysis platform that provides automated code review, technical debt tracking, and maintainability ratings. The platform focuses on code quality metrics rather than security (SAST/DAST).

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on

Website

Coverity

Coverity is an enterprise SAST tool from Synopsys (Software Integrity Group). Originally a Stanford research project focused on finding bugs in C/C++ code, Coverity has evolved into a comprehensive static analysis platform supporting 22+ la…

License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: OIDC, SAML

ResorsIT usage: Web App without SSO

Access & Identity: Single sign-on · Directory / LDAP

Website

CVE Lite CLI

CVE Lite CLI is an OWASP open-source SCA tool that scans JavaScript/TypeScript lockfiles against the OSV database and suggests copy-and-run fix commands, running fully locally with no account.

License: MIT (OSS) · Kind: web · Deploy: package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Dependabot

Dependabot is GitHub’s built-in dependency update and vulnerability alerting service. It automatically monitors project dependencies for known vulnerabilities and outdated versions, creating pull requests to update them.

License: MIT (OSS) · Kind: web · Deploy: saas, direct · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

DockSec

DockSec is an OWASP open-source Docker security scanner that runs Trivy, Hadolint, and Docker Scout against a Dockerfile and image, then uses an LLM layer to score findings and explain fixes in plain English.

License: MIT (OSS) · Kind: web · Deploy: docker, package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

ESLint

ESLint is the dominant JavaScript and TypeScript linting tool. It analyzes JavaScript/TypeScript source code to find problematic patterns, enforce coding conventions, and catch common bugs.

License: MIT (OSS) · Kind: web · Deploy: package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Fortify

Fortify is an enterprise application security testing platform originally developed by HP, then Micro Focus, and now owned by OpenText (following the 2023 acquisition of Micro Focus).

License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: OIDC, SAML

ResorsIT usage: Web App without SSO

Access & Identity: Single sign-on · Directory / LDAP

Website

GitLab SAST/DAST

GitLab SAST/DAST is the application security testing built into GitLab’s DevSecOps platform, wrapping open-source analyzers (Semgrep, Trivy, OWASP ZAP) into CI templates with a security dashboard.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on · Directory / LDAP

Website

gosec

gosec (Go Security Checker) is a static analysis tool specifically designed to find security vulnerabilities in Go source code.

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Nika

Nika is an open-source SAST tool from PhonePe that uses cross-file taint analysis and rule-based detection to find vulnerability patterns in Java microservices, with an optional AI false-positive review.

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Nuclei

Nuclei is a fast, template-based vulnerability scanner from ProjectDiscovery. It uses YAML templates to define HTTP, DNS, TCP, and other protocol-based checks, enabling security teams to scan targets for known vulnerabilities, misconfigurat…

License: MIT (OSS) · Kind: web · Deploy: saas, docker · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

OWASP Noir

OWASP Noir is an open-source static attack-surface detector that reads source code to extract an application’s endpoints, parameters, and shadow APIs and feed them to DAST and API-testing tools.

License: MIT (OSS) · Kind: web · Deploy: docker, package · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

OWASP ZAP

OWASP ZAP (Zed Attack Proxy) is the most widely used open-source dynamic application security testing (DAST) tool.

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Renovate

Renovate is an automated dependency update tool that creates pull/merge requests to keep project dependencies up to date.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct, docker · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Semgrep

Semgrep is a modern, lightweight static analysis tool that uses pattern-based matching to find bugs, security vulnerabilities, and code anti-patterns.

License: LGPL-2.1-only (OSS) · Kind: web · Deploy: direct · SSO: OIDC, SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on

Website · Source

Snyk

Snyk is the market leader in developer-first security, offering a comprehensive platform covering software composition analysis (SCA), static application security testing (SAST), container security, and infrastructure-as-code scanning.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on

Website

SonarQube Community Edition

SonarQube is the de facto standard for self-hosted continuous code quality and security analysis. The Community Edition provides SAST, code smell detection, code coverage aggregation, and technical debt tracking across 30+ languages.

License: LGPL-3.0-or-later (OSS) · Kind: web · Deploy: direct, docker, k8s · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Directory / LDAP

Website · Source

Trivy

Trivy is a comprehensive open-source vulnerability scanner from Aqua Security. Originally focused on container image scanning, Trivy has evolved into an all-in-one security scanner covering container images, filesystems, Git repositories, i…

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, k8s · SSO: none

ResorsIT usage: Web App without SSO

Access & Identity: Forward-auth · Vaulted credential

Website · Source

Veracode

Veracode is a leading enterprise application security platform offering SAST, DAST, SCA, and manual penetration testing as a unified cloud service.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

ResorsIT usage: Web App with SSO

Access & Identity: Single sign-on

Website