analysis-tools-dev / static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

phpstan / phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

e-m-b-a / emba

EMBA - The firmware security analyzer

Ericsson / codechecker

CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.

phpmd / phpmd

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

SVF-tools / SVF

Static Value-Flow Analysis Framework for Source Code

phpstan / phpdoc-parser

Next-gen phpDoc parser with support for intersection types and generics

fkie-cad / cwe_checker

cwe_checker finds vulnerable patterns in binary executables

SonarSource / SonarJS

SonarSource Static Analyzer for JavaScript and TypeScript

SonarSource / sonar-java

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

Cyber-Buddy / APKHunt

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

SonarSource / sonar-dotnet

Code analyzer for C# and VB.NET projects

phpstan / phpstan-doctrine

Doctrine extensions for PHPStan

kowainik / stan

🕵️ Haskell STatic ANalyser

BurtonQin / lockbud

Detect concurrency and memory bugs and possible panic locations in Rust projects