Skip to main content
IMMUNITYSEC

Application Security Tools

Static and dynamic security testing tools that scan source code, compiled binaries, and live web endpoints for code defects and known CVEs.

23 Tools Cataloged

Software in Application Security Tools

23 tools
Pricing
Platform
ToolPricing
42Crunch

API security platform auditing OpenAPI definitions and enforcing conformance at runtime.

Freemium
Acunetix

Web application and API vulnerability scanner, now sold as Invicti Web + API.

Commercial
Akto

Open source API security platform for discovery, inventory, and automated API testing.

Free / Commercial
Bandit

Security linter from PyCQA that processes Python ASTs to find common vulnerability patterns and insecure library usages.

Open Source
Burp Suite

Web vulnerability assessment platform and intercepting proxy suite for testing web applications, APIs, and access controls.

Free / Commercial
Checkmarx One

Cloud-native application security platform unifying SAST, SCA, API security, and container scanning.

Commercial
CodeQL

Semantic code analysis engine that compiles source code into queryable databases to discover vulnerabilities with QL queries.

Free / Commercial
Dalfox

XSS scanner and parameter mining tool that parses HTML responses, tests injection points, and reports cross-site scripting weaknesses.

Open Source
detect-secrets

Yelp open source secrets scanner with a baseline workflow designed for enterprise adoption.

Open Source
GitGuardian

Secrets detection platform scanning repositories, CI, and developer tools, with non-human identity governance.

Freemium
GitHub Advanced Security

Native GitHub appsec stack: CodeQL code scanning, secret scanning with push protection, and dependency review.

Freemium
Gitleaks

Open-source secret scanner for git repositories, CI/CD pipelines, and pre-commit hooks, detecting hardcoded API keys, tokens, and passwords.

Open Source
gosec

Static security checker from SecureGo that inspects Go AST and SSA code representations to identify security flaws and bad practices.

Open Source
Invicti

Application security platform built around proof-based DAST, formerly Netsparker.

Commercial
OpenText Fortify

Enterprise SAST and DAST suite with Fortify on Demand managed testing service.

Commercial
Salt Security

API and agentic AI security platform using behavioral analysis of traffic to detect API abuse and posture gaps.

Commercial
Semgrep

Fast static analysis engine for codebases and CI/CD pipelines, matching semantic code patterns to find security vulnerabilities.

Free / Commercial
Snyk

Freemium application security platform that scans source code, open-source dependencies, containers, and IaC for vulnerabilities and license issues.

Freemium
SonarQube

Multi-language static analysis and code quality platform with open-source Community Build and commercial Server and Cloud editions.

Free / Commercial
StackHawk

DAST platform configured as code for CI/CD pipelines.

Commercial
TruffleHog

Open-source and commercial secret scanner with verified credential detection across source code, cloud storage, CI/CD, and SaaS platforms.

Free / Commercial
Veracode

Application risk platform with source and binary SAST, DAST, SCA, and penetration testing as a service.

Commercial
ZAP

Open-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.

Free / Commercial

About Application Security Tools

Application security tools scan source code, compiled binaries, and running web applications for vulnerabilities. The category includes static analysis tools (SAST) that parse code patterns and data flow without executing the program, dynamic analysis tools (DAST) that test live endpoints by sending crafted requests, and software composition analysis tools (SCA) that check declared dependencies against vulnerability databases. SAST tools catch issues like SQL injection, path traversal, and hardcoded secrets during development. DAST tools find runtime problems that static analysis misses, including missing security headers and injection flaws confirmed against the running application. SCA tools identify known CVEs in third-party libraries and container images. Modern SAST engines like Semgrep let teams write custom rules that match their internal coding standards, while DAST scanners like ZAP integrate into CI pipelines for continuous endpoint testing. The combination of all three approaches provides layered coverage: SAST catches issues early in development, SCA prevents vulnerable dependencies from shipping, and DAST validates running applications against real-world attack patterns.

Covered Topics

Static Application Security Testing (SAST)Dynamic Application Security Testing (DAST)Software Composition Analysis (SCA)Source Code AuditingCI/CD Pipeline Security

In This Catalog

  • This category lists 23 tools: 7 commercial, 7 free / commercial, 5 open source, and 4 freemium.
  • By platform, 14 run on Linux, 13 on Windows, 12 on macOS, and 11 on the web.
  • The most common license among the open-source tools is Apache-2.0 (3 tools).

Frequently Asked Questions

What is Application Security Tools?→

Static and dynamic security testing tools that scan source code, compiled binaries, and live web endpoints for code defects and known CVEs.

What topics does the Application Security Tools category cover?→

Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Source Code Auditing, CI/CD Pipeline Security

Which Application Security tools are open source?→

5 of the 23 tools in this category are open source: Bandit, Dalfox, detect-secrets, Gitleaks, and gosec.

Related

Tool categories

Cloud Security ToolsPenetration Testing ToolsSoftware Composition Analysis Tools

Certifications

GAIPSHTB CWESCSSLP

Weaknesses (CWE)

CWE-20 Improper Input ValidationCWE-22 Path TraversalCWE-36 Absolute Path TraversalCWE-59 Link FollowingCWE-73 External Control of File Name or PathCWE-74 Injection
+97 moreCWE-77 Command InjectionCWE-78 OS Command InjectionCWE-79 Cross-site ScriptingCWE-89 SQL InjectionCWE-94 Code InjectionCWE-95 Eval InjectionCWE-200 Exposure of Sensitive InformationCWE-269 Improper Privilege ManagementCWE-284 Improper Access ControlCWE-287 Improper AuthenticationCWE-288 Authentication Bypass via Alternate PathCWE-290 Authentication Bypass by SpoofingCWE-306 Missing Authentication for Critical FunctionCWE-347 Improper Verification of Cryptographic SignatureCWE-434 Unrestricted File UploadCWE-502 Deserialization of Untrusted DataCWE-693 Protection Mechanism FailureCWE-863 Incorrect AuthorizationCWE-918 Server-Side Request ForgeryCWE-23 Relative Path TraversalCWE-24 Path TraversalCWE-35 Path TraversalCWE-44 Path EquivalenceCWE-61 UNIX Symbolic Link FollowingCWE-80 Script-related HTML Tag InjectionCWE-88 Argument InjectionCWE-90 LDAP InjectionCWE-91 XML InjectionCWE-96 Static Code InjectionCWE-98 Remote File InclusionCWE-116 Improper Encoding or Escaping of OutputCWE-158 Improper Neutralization of Null ByteCWE-184 Incomplete List of Disallowed InputsCWE-209 Sensitive Information in Error MessagesCWE-255 Credentials Management ErrorsCWE-259 Use of Hard-coded PasswordCWE-285 Improper AuthorizationCWE-295 Improper Certificate ValidationCWE-303 Incorrect Authentication Algorithm ImplementationCWE-305 Authentication Bypass by Primary WeaknessCWE-310 Cryptographic IssuesCWE-311 Missing Encryption of Sensitive DataCWE-312 Cleartext Storage of Sensitive InformationCWE-319 Cleartext Transmission of Sensitive InformationCWE-320 Key Management ErrorsCWE-321 Use of Hard-coded Cryptographic KeyCWE-325 Missing Cryptographic StepCWE-326 Inadequate Encryption StrengthCWE-327 Use of a Broken or Risky Cryptographic AlgorithmCWE-328 Use of Weak HashCWE-330 Use of Insufficiently Random ValuesCWE-331 Insufficient EntropyCWE-346 Origin Validation ErrorCWE-352 Cross-Site Request ForgeryCWE-359 Exposure of Private Personal InformationCWE-362 Race ConditionCWE-367 Time-of-check Time-of-use Race ConditionCWE-388 7PK - ErrorsCWE-424 Improper Protection of Alternate PathCWE-425 Forced BrowsingCWE-435 Improper Interaction Between EntitiesCWE-436 Interpretation ConflictCWE-441 Unintended Proxy or IntermediaryCWE-444 HTTP Request SmugglingCWE-451 UI Misrepresentation of Critical InformationCWE-470 Use of Externally-Controlled Input to Select Classes or CodeCWE-472 External Control of Web ParameterCWE-473 PHP External Variable ModificationCWE-522 Insufficiently Protected CredentialsCWE-528 Exposure of Core Dump FileCWE-532 Sensitive Information in Log FilesCWE-552 Files Accessible to External PartiesCWE-565 Reliance on Cookies without Integrity CheckingCWE-611 XML External Entity ReferenceCWE-639 Authorization Bypass via User-Controlled KeyCWE-640 Weak Password Recovery MechanismCWE-645 Overly Restrictive Account LockoutCWE-647 URL Paths for Authorization DecisionsCWE-668 Exposure of Resource to Wrong SphereCWE-691 Insufficient Control Flow ManagementCWE-697 Incorrect ComparisonCWE-703 Improper Check or Handling of Exceptional ConditionsCWE-707 Improper NeutralizationCWE-794 Incomplete Filtering of Special ElementsCWE-798 Use of Hard-coded CredentialsCWE-807 Untrusted Inputs in a Security DecisionCWE-862 Missing AuthorizationCWE-913 Improper Control of Dynamically-Managed CodeCWE-916 Password Hash with Insufficient Computational EffortCWE-917 Expression Language InjectionCWE-942 Permissive Cross-domain PolicyCWE-943 Improper Neutralization of Special Elements in Data Query LogicCWE-1220 Insufficient Granularity of Access ControlCWE-1287 Improper Validation of Input TypeCWE-1321 Prototype PollutionCWE-1336 Template InjectionCWE-1390 Weak Authentication