qltysh / qlty
💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability
qltysh / qlty
soot-oss / soot
Soot - A Java optimization framework
SamboyCoding / Cpp2IL
Work-in-progress tool to reverse unity's IL2CPP toolchain.
Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Ericsson / codechecker
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
CodeBoarding / CodeBoarding
Interactive architecture diagrams for codebases
ajinabraham / nodejsscan
nodejsscan is a static security code scanner for Node.js applications.
google / mantis
A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.
MG1937 / ASC
ASC is a super FAST and lightweight Android decompiler designed for Agents/Mobile Researchers.
phpmd / phpmd
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
find-sec-bugs / find-sec-bugs
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
betterleaks / betterleaks
Find leaked secrets everywhere.
JoshuaKGoldberg / TypeStat
Converts JavaScript to TypeScript and TypeScript to better TypeScript. 🧫
AhmadHassan-BTed / OpenHeart
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
mbj / mutant
Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?
glebm / i18n-tasks
Manage translation and localization with static analysis, for Ruby i18n
INRIA / spoon
Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.
clj-kondo / clj-kondo
Static analyzer and linter for Clojure code that sparks joy
SVF-tools / SVF
Static Value-Flow Analysis Framework for Source Code
PHPCSStandards / PHP_CodeSniffer
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
hyhmrright / brooks-lint
AI code reviews grounded in 12 classic engineering books — decay risk diagnostics with book citations, severity labels, and 6 analysis modes including full-sweep auto-fix
phpstan / phpdoc-parser
Next-gen phpDoc parser with support for intersection types and generics
huhusmang / Awesome-LLMs-for-Vulnerability-Detection
The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.
controlplaneio / kubesec
Security risk analysis for Kubernetes resources
nowsecure / r2frida
Radare2 and Frida better together.
ZupIT / horusec
Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
pschanely / CrossHair
An analysis tool for Python that blurs the line between testing and type systems.
jakzal / phpqa
Docker image that provides static analysis tools for PHP
SonarSource / SonarJS
SonarSource Static Analyzer for JavaScript and TypeScript
semgrep / semgrep-rules
Semgrep Community Edition rules, maintained by Semgrep and the community. Free to use under the Semgrep Rules License.
secure-software-engineering / FlowDroid
FlowDroid Static Data Flow Tracker
ipyflow / ipyflow
A reactive Python kernel for Jupyter notebooks.
mongodb / kingfisher
Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
zubanls / zuban
Python Type Checker / Language Server
SonarSource / sonar-java
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
meziantou / Meziantou.Analyzer
A powerful C# Roslyn analyzer that uses static analysis to detect bugs, surface security issues, and enforce best practices—helping developers and AI write more reliable code.
jspecify / jspecify
An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.
safedep / vet
Protect against malicious open source packages 🤖
ludo-technologies / pyscn
Code quality analysis for Python in the age of AI coding.
dkorunic / betteralign
Detect and fix suboptimal struct field layout in Go: reduces padding and GC pointer bytes, rewrites files while preserving comments. A drop-in fieldalignment replacement.
secure-software-engineering / phasar
A LLVM-based static analysis framework.
morluto / awesome-reverse-engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
Cyber-Buddy / APKHunt
APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.
SonarSource / sonar-dotnet
Code analyzer for C# and VB.NET projects
gmh5225 / awesome-llvm-security
awesome llvm security [Welcome to PR]
aviatesk / JET.jl
A code analyzer for Julia. No need for additional type annotations.
0xdea / semgrep-rules
A collection of my Semgrep rules to facilitate vulnerability research.
wala / WALA
T.J. Watson Libraries for Analysis, with front ends for Java, Android, and JavaScript, and many common static program analyses.
asamassekou10 / ship-safe
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
rubocop / rubocop-rspec
Code style checking for RSpec files.
duriantaco / skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
soot-oss / SootUp
A new version of Soot with a completely overhauled architecture
phpstan / phpstan-symfony
Symfony extension for PHPStan
MobSF / mobsfscan
mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
openqodex / openqodex
Open source code review that runs in your coding agent before you push. Scanners plus a separate AI reviewer, on your own login, no key.
bartolli / codanna
Local code intelligence MCP server and CLI for AI coding agents
appvia / krane
Kubernetes RBAC static analysis & visualisation tool
phpstan / phpstan-strict-rules
Extra strict and opinionated rules for PHPStan
thradams / cake
Cake a C23 front end and transpiler written in C
lkimuk / ReArk
An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries.