Guide

SAST tools compared: what they find and what they miss

What SAST tools do, how eight widely used ones differ in approach, languages and licensing, and what static analysis misses in AI-generated code.

November 10, 2026 · 9 min read · By the vetkit team

What a SAST tool is

A SAST (static application security testing) tool reads your source code without running it and reports code that looks vulnerable: request data that reaches a SQL query, a shell command built from user input, a disabled certificate check, a weak hash used for passwords. Because it needs only the source, it can run on every commit, long before the application is deployed.

SAST is one of several kinds of security testing. SCA (software composition analysis) checks your dependencies for known vulnerabilities, secret scanning looks for committed credentials, and DAST (dynamic testing) probes a running application. A SAST tool does none of those, so most teams combine it with at least dependency and secret scanning.

How SAST tools differ

Four differences explain most of what you will notice when you try two tools on the same code.

How deep the analysis goes. Pattern matching finds code that looks like a known bad shape. Taint or data-flow analysis follows a value from where it enters (a request) to where it is used (a query). Following values across functions and files finds more real problems, and it is usually where commercial editions differ from free ones.
One language or many. Single-language tools know their ecosystem well. Multi-language tools give one report for a mixed codebase.
Where it runs. Some are a command you run locally or in CI. Others are hosted platforms that connect to your source control and add dashboards, pull request comments and policy.
Whether you can write your own rules. Readable rule formats make it practical to encode your team’s own conventions.

Eight SAST tools side by side

These are widely used tools, listed alphabetically within each group. The table records what each project’s own documentation says; it is not a ranking and we have not benchmarked them against each other.

SAST tools compared
Tool	Approach, per its documentation	Languages	Licensing	SARIF output
CodeQL (GitHub code scanning)	Builds a database from the code and runs semantic queries against it	C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows	CLI free to use on public repositories; private repositories need a GitHub Code Security license	Yes
Checkmarx One SAST	Builds a graph of code elements and data flows and runs queries; custom queries supported	Multi-language, including Java, C#, C/C++, PHP, JavaScript/TypeScript, Python and Go	Commercial	Yes
Opengrep	Pattern rules with taint analysis; compatible with Semgrep rules	30+ languages	Open source, LGPL 2.1	Yes
Semgrep	Pattern rules that look like the code they match. Community Edition analyses within a single function or file; the commercial Semgrep Code adds analysis across files and functions	30+ languages	Engine open source, LGPL 2.1; AppSec Platform is proprietary	Yes
Snyk Code	Semantic analysis engine with data flow and taint analysis	Multi-language, including Java/Kotlin, JavaScript/TypeScript, Python, Go, C#, PHP, Ruby and Swift	Commercial hosted service with a free plan	Yes
SonarQube	Code quality and security rules; taint analysis for injection rules is available in SonarQube Server and Cloud	40+ languages and frameworks across editions	Community Build is open source, LGPL 3.0; Server and Cloud are commercial	Imports SARIF from other tools
Bandit	Builds a syntax tree for each file and runs plugins against it	Python only	Open source, Apache 2.0	Yes, with an optional extra
gosec	Syntax tree rules, SSA-based analyzers and taint analysis	Go only	Open source, Apache 2.0	Yes

Brakeman is another well-known single-framework tool, for Ruby on Rails. Its repository describes it as free for non-commercial use under its own public use license, so check the terms before building it into a commercial service.

Several of these now offer AI-assisted fixes or triage under their own names, for example Copilot Autofix for CodeQL alerts, Semgrep Multimodal, Snyk Agent Fix and SonarQube AI CodeFix. Names, editions and prices in this area change often, so read each vendor’s current page before you decide.

How to choose

One language, small team. Start with the single-language tool for your stack (Bandit for Python, gosec for Go). They are free, quick to run and easy to add to CI.
Mixed codebase, want open source. A rule-based multi-language engine such as Opengrep or Semgrep Community Edition covers many languages with rules you can read and extend.
Everything is on GitHub. CodeQL through GitHub code scanning puts alerts in pull requests with no extra service. See GitHub Advanced Security vs vetkit.
You need deeper cross-file analysis, dashboards and policy. That is what the commercial platforms sell. Compare them on your own code, not on feature lists. See Semgrep vs vetkit and Snyk vs vetkit.

Whichever you pick, prefer a tool that writes SARIF. It is the common format that lets you send findings to GitHub code scanning or another dashboard, and move between tools later. The SARIF guide explains how.

What SAST misses

SAST finds insecure code patterns. A lot of what goes wrong in software, especially software written quickly with an AI assistant, is not a pattern in one file.

Problem	Why SAST alone does not catch it	What does
A package that does not exist or was registered last week	The import statement is valid code	Dependency checks against the public registries
Committed credentials	Most SAST rules look at code behaviour, not at secret formats	Secret scanning
Known vulnerabilities in dependencies	The vulnerable code is not in your repository	Software composition analysis
Missing authorization between users	The code is syntactically fine; the rule that is missing lives in your product’s design	Review and a test with two accounts
Unfinished or placeholder implementations	Not a security pattern	Code quality and AI-risk checks, and review
No timeouts, queries inside loops, no error reporting	Reliability problems, outside most security rule sets	Production readiness checks
Misconfigured hosting or database permissions	The setting is in a console, not in the source	Checking the deployed environment

This is why a clean SAST report is not the same as code that is ready to ship. The guide to what goes wrong with vibe coding and the invented packages guide go through the cases that matter most for AI-assisted code.

Where vetkit fits

vetkit is not a SAST engine of its own. It is a repository audit that runs static analysis as one part of a wider report. For code security it uses Opengrep with 663 first-party rules, listed in the public check catalog, and adds Bandit for Python and gosec for Go when those checks are selected. Around that it runs secret scanning, dependency vulnerability and package-existence checks, code quality, AI code risk and production readiness checks, and turns the findings into tracked work. Findings can be exported as SARIF.

If you already run one of the tools above and are happy with it, keep it. vetkit is useful for the rows in the second table, and it is in early access with a free Security Quick Scan that covers secrets, known dependency vulnerabilities and basic posture.

Sources

We read the statements about other tools from their own documentation or repositories on November 10, 2026. Products change quickly, so treat each project’s own pages as the final word:

Product names are trademarks of their respective owners. vetkit is not affiliated with, endorsed by or sponsored by them; names are used only to identify the tools. Spotted something out of date? Email contact@vetkit.dev and we will correct it.