For Python, start with Bandit. For Java, Find Security Bugs. For Go, gosec. For JavaScript, eslint-plugin-security plus a general scanner. General tools such as Semgrep and CodeQL cover all four, so most teams pair one general tool with the language-specific scanner for their main language.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Details are as of 19 October 2026.
Key takeaways
- Language-specific scanners are free and quick to add.
- General tools give one workflow across languages and are better when you have a polyglot repository.
- Support differs by language. CodeQL, for example, does not support PHP or Scala.
- Treat every finding as a lead to verify, especially from pattern-based rules.
Which SAST tool is best for Python?
Bandit is the Python-focused option. Its docs say it finds common security issues in Python code by building an AST from each file and running plugins against the nodes. Install with pip install bandit, scan with bandit -r on a folder, filter to high severity with -lll, and use a JSON baseline with -b to ignore known issues. Extras add TOML and SARIF output. For deeper checks, add Semgrep or CodeQL, which lists Python support.
Which SAST tool is best for JavaScript and TypeScript?
Combine eslint-plugin-security with a general scanner. The plugin adds 15 rules for Node.js hotspots such as eval with expressions, non-literal child_process calls and unsafe regular expressions. Its README warns it finds many false positives that need human triage and flags hotspots, not confirmed vulnerabilities. It needs ESLint 8.23.0 or later for flat config. CodeQL covers JavaScript and TypeScript, and Semgrep lists both.
Which SAST tool is best for Java?
Find Security Bugs is the Java-specific option. It is a SpotBugs plugin for Java web applications that detects 144 vulnerability types and recognizes more than 826 API signatures, with frameworks such as Spring MVC and Struts named. It runs from Maven or Ant, IDE plugins, Jenkins or SonarQube, and is LGPL licensed. The page shows version 1.14.0 from April 2025. CodeQL covers Java and Kotlin together.
Which SAST tool is best for Go?
gosec is the Go-specific option. It is Apache-2.0, scans the Go AST and SSA representations, and includes taint analysis rules for injection, path traversal and SSRF. It requires Go 1.25 or newer, runs with gosec ./..., and has a GitHub Action and SARIF output. Findings can be suppressed with a nosec comment plus a justification.
How do they compare?
| Language | Language-specific option | General options that list the language | Notes |
|---|---|---|---|
| Python | Bandit | Semgrep, CodeQL, SonarQube Community Build | Bandit supports baselines and SARIF |
| JavaScript | eslint-plugin-security | Semgrep, CodeQL (JavaScript/TypeScript), SonarQube Community Build | README warns of false positives |
| Java | Find Security Bugs | CodeQL (Java/Kotlin), Semgrep, SonarQube Community Build | Maven, Ant, IDE support |
| Go | gosec | CodeQL, Semgrep, SonarQube Community Build | Includes taint rules |
What if I use several languages?
Use one general tool as the base and add one language-specific scanner only where your code is concentrated. GitLab's built-in SAST uses Semgrep-based analyzers for most languages, and SpotBugs with find-sec-bugs for Groovy. Choose by CI fit: see SAST in pull requests.
How do I choose?
- Count lines of code per language and prioritize the biggest.
- Add the language-specific scanner locally and read 20 findings.
- Add a general scanner and compare overlap.
- Keep what your developers fix. Drop what they ignore.
- Cover dependencies separately with the free in-browser dependency scan.
Frequently asked questions
Is Bandit enough for Python?
It covers common Python issues but is a single tool. Pair it with a general scanner for broader checks.
Does CodeQL support PHP?
No. GitHub's docs say PHP and Scala are not supported.
Can gosec scan private modules?
Yes, with GOPRIVATE and a read-access token set, per the gosec README.
Do language-specific scanners replace general SAST?
No. They go deeper in one language. Teams often use both.
Which language scanner is easiest to start with?
Bandit and gosec are each one install and one command, per their docs.
Sources
- Bandit docs: https://bandit.readthedocs.io/en/latest/
- Bandit getting started: https://bandit.readthedocs.io/en/latest/start.html
- eslint-plugin-security: https://github.com/nodesecurity/eslint-plugin-security
- Find Security Bugs: https://find-sec-bugs.github.io/
- gosec: https://github.com/securego/gosec
- GitHub CodeQL docs: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql
- Semgrep repository README: https://github.com/semgrep/semgrep
- SonarQube downloads: https://www.sonarsource.com/products/sonarqube/downloads/
- GitLab SAST docs: https://docs.gitlab.com/user/application_security/sast/
Last reviewed: 19 October 2026.
