License & Deployment Mix: 17 tools – 10 OSS, 5 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

What Is Code Quality / SAST / DAST Software?

Code quality and application security testing tools analyze source code, binaries, and running applications to find bugs, vulnerabilities, code smells, and compliance issues. This category spans several overlapping disciplines:

• Static Application Security Testing (SAST) – analyzes source code or bytecode without executing it; finds vulnerabilities like SQL injection, XSS, buffer overflows, and insecure cryptography at development time
• Dynamic Application Security Testing (DAST) – tests running applications by sending crafted requests and analyzing responses; finds runtime vulnerabilities that SAST cannot detect
• Software Composition Analysis (SCA) – scans project dependencies (libraries, frameworks, container images) for known CVEs and license compliance issues
• Code linting – enforces coding style, formatting rules, and language-specific best practices; catches common programming errors before they become bugs
• Code coverage – measures how much of the codebase is exercised by automated tests; identifies untested code paths
• Vulnerability scanning – broader category covering container images, infrastructure-as-code templates, and cloud configurations for security misconfigurations
• Dependency management – automates dependency updates and monitors for newly disclosed vulnerabilities in project dependencies

Unlike general-purpose CI/CD tools, code quality and security testing tools focus specifically on the analysis and improvement of code and application security posture.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

Category Matrix

* = Semgrep SCA requires commercial license ** = Nuclei is template-based vulnerability scanning, not traditional DAST

Language Support

Deployment Comparison

* = SonarCloud (SaaS) ** = Semgrep Cloud Platform dashboard is SaaS-only; OSS engine is CLI *** = CodeClimate analysis engine (Docker CLI) **** = ProjectDiscovery Cloud (commercial)

Licensing Comparison

SSO / OIDC Comparison

OIDC is the preferred SSO protocol.

* = requires paid/enterprise tier ? = not prominently documented

Best SSO support: Checkmarx, Fortify, Coverity, and GitLab offer full OIDC/SAML/LDAP support. SonarQube Community Edition is limited to LDAP. CLI tools (gosec, Bandit, ESLint, Trivy, ZAP, Nuclei) do not require SSO.

Go Support Detail

This table compares Go-specific capabilities.

Best for Go SAST: gosec (purpose-built) + Semgrep (pattern-based with custom rules) is the recommended combination.

Best for Go SCA: Trivy (free, comprehensive) or Snyk (commercial, curated database).

Best for Go dependency updates: Renovate (most configurable) or Dependabot (simplest on GitHub).

CI/CD Integration Comparison

Tools

17 tools.

Bandit

Bandit is a Python-specific static analysis tool designed to find common security issues in Python code.

License: Apache-2.0 (OSS) · Kind: web · Deploy: package · SSO: none

Website · Source

Checkmarx

Checkmarx is a leading enterprise application security testing (AST) platform. The flagship product, Checkmarx One, is a cloud-native platform combining SAST, SCA, DAST, API security, supply chain security, and IaC scanning in a unified das…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

CodeClimate Quality

CodeClimate Quality is a code analysis platform that provides automated code review, technical debt tracking, and maintainability ratings. The platform focuses on code quality metrics rather than security (SAST/DAST).

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

Website

Coverity

Coverity is an enterprise SAST tool from Synopsys (Software Integrity Group). Originally a Stanford research project focused on finding bugs in C/C++ code, Coverity has evolved into a comprehensive static analysis platform supporting 22+ la…

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Dependabot

Dependabot is GitHub’s built-in dependency update and vulnerability alerting service. It automatically monitors project dependencies for known vulnerabilities and outdated versions, creating pull requests to update them.

License: MIT (OSS) · Kind: web · Deploy: saas, native · SSO: none

Website · Source

ESLint

ESLint is the dominant JavaScript and TypeScript linting tool. It analyzes JavaScript/TypeScript source code to find problematic patterns, enforce coding conventions, and catch common bugs.

License: MIT (OSS) · Kind: web · Deploy: package · SSO: none

Website · Source

Fortify

Fortify is an enterprise application security testing platform originally developed by HP, then Micro Focus, and now owned by OpenText (following the 2023 acquisition of Micro Focus).

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

GitLab SAST/DAST

GitLab SAST/DAST is the application security testing built into GitLab’s DevSecOps platform, wrapping open-source analyzers (Semgrep, Trivy, OWASP ZAP) into CI templates with a security dashboard.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

gosec

gosec (Go Security Checker) is a static analysis tool specifically designed to find security vulnerabilities in Go source code.

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, package · SSO: none

Website · Source

Nuclei

Nuclei is a fast, template-based vulnerability scanner from ProjectDiscovery. It uses YAML templates to define HTTP, DNS, TCP, and other protocol-based checks, enabling security teams to scan targets for known vulnerabilities, misconfigurat…

License: MIT (OSS) · Kind: web · Deploy: saas, docker · SSO: none

Website · Source

OWASP ZAP

OWASP ZAP (Zed Attack Proxy) is the most widely used open-source dynamic application security testing (DAST) tool.

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker · SSO: none

Website · Source

Renovate

Renovate is an automated dependency update tool that creates pull/merge requests to keep project dependencies up to date.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Semgrep

Semgrep is a modern, lightweight static analysis tool that uses pattern-based matching to find bugs, security vulnerabilities, and code anti-patterns.

License: LGPL-2.1-only (OSS) · Kind: web · Deploy: native · SSO: SAML

Website · Source

Snyk

Snyk is the market leader in developer-first security, offering a comprehensive platform covering software composition analysis (SCA), static application security testing (SAST), container security, and infrastructure-as-code scanning.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

SonarQube Community Edition

SonarQube is the de facto standard for self-hosted continuous code quality and security analysis. The Community Edition provides SAST, code smell detection, code coverage aggregation, and technical debt tracking across 30+ languages.

License: LGPL-3.0-or-later (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none

Website · Source

Trivy

Trivy is a comprehensive open-source vulnerability scanner from Aqua Security. Originally focused on container image scanning, Trivy has evolved into an all-in-one security scanner covering container images, filesystems, Git repositories, i…

License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, k8s · SSO: none

Website · Source

Veracode

Veracode is a leading enterprise application security platform offering SAST, DAST, SCA, and manual penetration testing as a unified cloud service.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

Website