Application Security Tools

API security platform auditing OpenAPI definitions and enforcing conformance at runtime.

Web application and API vulnerability scanner under the Invicti portfolio.

Open source API security platform for discovery, inventory, and automated API testing.

Security linter from PyCQA that processes Python ASTs to find common vulnerability patterns and insecure library usages.

Web vulnerability assessment platform and intercepting proxy suite for testing web applications, APIs, and access controls.

Cloud-native application security platform unifying SAST, SCA, API security, and container scanning.

Semantic code analysis engine that compiles source code into queryable databases to discover vulnerabilities with QL queries.

XSS scanner and parameter mining tool that parses HTML responses, tests injection points, and reports cross-site scripting weaknesses.

Yelp open source secrets scanner with a baseline workflow designed for enterprise adoption.

Secrets detection platform scanning repositories, CI, and developer tools, with non-human identity governance.

Native GitHub appsec stack: CodeQL scanning, Copilot secret scanning, and dependency review.

Lightweight open-source secret scanner for git repositories, CI/CD pipelines, and pre-commit hooks, detecting hardcoded API keys, tokens, and passwords.

Static security checker from SecureGo that inspects Go AST and SSA code representations to identify security flaws and bad practices.

Enterprise DAST platform with proof-based vulnerability confirmation, formerly Netsparker.

Enterprise SAST and DAST suite with Fortify on Demand managed testing service.

API protection platform using ML over traffic to detect API abuse, logic flaws, and posture gaps.

Fast static analysis engine for codebases and CI/CD pipelines, matching syntactic patterns to find security vulnerabilities.

Freemium application security platform that scans source code, open-source dependencies, containers, and IaC for vulnerabilities and license issues.

Multi-language static analysis and code quality platform with open-source Community Edition and commercial Server and Cloud editions for continuous inspection.

Developer-first DAST platform configured as code for CI/CD pipelines.

Open-source and commercial secret scanner with verified credential detection across source code, cloud storage, CI/CD, and SaaS platforms.

Application risk platform with binary SAST, DAST, SCA, and managed penetration testing.

Open-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.