The main open source SAST tools are Semgrep Community Edition for many languages, SonarQube Community Build for quality and basic security, and language-specific scanners: Bandit for Python, gosec for Go, Find Security Bugs for Java and eslint-plugin-security for Node.js. They differ in license, depth and how much noise they produce.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Details are as of 19 October 2026.
Key takeaways
- Open source engines are free to run, but "open source" does not always cover the rules: Semgrep-maintained rules carry a separate license.
- General tools cover many languages with shallower analysis. Language-specific tools cover one language in more detail.
- Several of these tools state their own false positive limits. Plan for triage.
- Most can emit SARIF or integrate with CI, so you can combine them.
Which open source SAST tools exist?
OWASP's source code analysis tools page lists many open source scanners, including Bandit, Brakeman, FindSecBugs, Semgrep, SonarQube, SpotBugs, PMD, Psalm and nodejsscan. This guide compares the ones with current documentation we could fetch. Listing on OWASP does not mean a tool is maintained today, so check the repository activity before you adopt one.
How do they compare?
Use this table as a starting filter. Every cell comes from the project's docs or repository page.
| Tool | Languages | License | How it analyzes | CI and output | Stated limits |
|---|---|---|---|---|---|
| Semgrep CE | 30+ languages including Python, JavaScript, TypeScript, Java, Go, Ruby and C | Engine LGPL-2.1. Semgrep-maintained rules under Semgrep Rules License v1.0 for internal business use | Pattern rules, run locally with semgrep ci or a one-off scan | CI job with diff-aware option | Community Edition analyzes within a single function or file |
| SonarQube Community Build | 40+ languages per its docs | Free and open source, self-managed | Rules for maintainability, reliability and security | Integrates with CI and DevOps platforms | Sonar lists taint analysis and PR analysis under paid editions |
| Bandit | Python | See the project repository | Builds an AST per file and runs plugins on nodes | CLI, baseline file, SARIF extra | Python only |
| gosec | Go | Apache-2.0 | Go AST and SSA, plus taint rules | GitHub Action, SARIF, JUnit and other formats | Go only |
| Find Security Bugs | Java web applications | LGPL | SpotBugs plugin with 144 vulnerability types | Maven, Ant, IDE plugins, Jenkins, SonarQube | Version 1.14.0 dated April 2025 |
| eslint-plugin-security | JavaScript on Node.js | Apache-2.0 | 15 ESLint rules | Runs as part of ESLint | README says it finds many false positives that need human triage |
| CodeQL (engine) | C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift | Private repo use needs a GitHub Code Security license | Builds a database and runs queries | GitHub Actions or external CI | Does not support PHP or Scala |
CodeQL is included because people often ask about it. GitHub's docs say private repository use of code scanning needs a license, so it is not free in every case.
What is the difference between a general and a language-specific tool?
General tools such as Semgrep use one engine across many languages, so you get one workflow and one report. Language-specific tools know their ecosystem. gosec ships rule groups for Go crypto, file handling and injection. Bandit has plugins built for Python constructs. Find Security Bugs recognizes more than 826 Java API signatures.
A common approach is one general tool plus the language-specific scanner for your main language, then dropping whichever finds nothing your team acts on.
Is open source SAST really free for commercial use?
The Semgrep engine is LGPL-2.1, and Semgrep's FAQ says you can use it on private and proprietary code at work. The rules are different: Semgrep-maintained rules are for internal business purposes and cannot be resold. If you scan code for clients as a paid service, read that FAQ first. For every tool, read the license file in the repository rather than relying on a summary.
What are the real limits of open source SAST?
OWASP lists the shared weaknesses: high false positives, difficulty proving a finding is exploitable, and trouble with code that cannot be built without its libraries. On top of that, community editions often hold back deeper analysis. Semgrep's README says Community Edition analyzes within a function or file, and Sonar's downloads page lists taint analysis in paid editions.
How do I choose?
- Pick the tools whose docs list your language.
- Check the license for rules as well as engine.
- Confirm output formats match your CI. SARIF lets GitHub code scanning display results from any tool that emits it.
- Run each on one repository and have a developer triage 20 findings.
- Keep the tools whose findings were fixed, and remove the rest.
For dependencies, which SAST does not cover, try the free in-browser dependency scan. It needs no login and keeps the file on your machine, up to 100 dependencies.
Frequently asked questions
What is the best open source SAST tool?
There is no sourced single winner. Semgrep is the broadest by language count, and language-specific tools go deeper on one language. Trial on your own code.
Is SonarQube Community Build a SAST tool?
Its docs describe rules for maintainability, reliability and security. Sonar's downloads page lists taint analysis only under paid editions, so it is closer to code quality with basic vulnerability checks.
Is Semgrep free?
The engine is LGPL-2.1 and free to run. The AppSec Platform Team tier is free for up to 10 contributors on private repositories, per Semgrep's FAQ.
Can I run several open source SAST tools together?
Yes. Many output SARIF or JSON, and GitHub shows each tool's results separately on a pull request.
Does open source SAST find dependency vulnerabilities?
No. That is software composition analysis, a separate scan.
Sources
- Semgrep repository README: https://github.com/semgrep/semgrep
- Semgrep FAQ: https://docs.semgrep.dev/faq/overview
- SonarQube Community Build docs: https://docs.sonarsource.com/sonarqube-community-build/
- SonarQube downloads: https://www.sonarsource.com/products/sonarqube/downloads/
- Bandit docs: https://bandit.readthedocs.io/en/latest/
- gosec: https://github.com/securego/gosec
- Find Security Bugs: https://find-sec-bugs.github.io/
- eslint-plugin-security: https://github.com/nodesecurity/eslint-plugin-security
- GitHub CodeQL docs: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql
- GitHub about code scanning: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning
- GitHub SARIF support: https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
- OWASP Source Code Analysis Tools: https://community.owasp.org/Source_Code_Analysis_Tools
Last reviewed: 19 October 2026.
