Application Security (SAST/DAST/SCA)
Static and dynamic security testing tools that scan source code, compiled binaries, and live web endpoints for code defects and known CVEs.
| Tool | License | Platforms | Pricing | Action |
|---|---|---|---|---|
| Bandit | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| Burp Suite | Proprietary | Windows, macOS, Linux | Free / Commercial | Profile→ |
| CodeQL | MIT (queries); proprietary CLI | Linux, macOS, Windows | Free / Commercial | Profile→ |
| Dalfox | MIT | Linux, macOS, Windows | Open Source | Profile→ |
| Gitleaks | MIT | Linux, macOS, Windows | Open Source | Profile→ |
| gosec | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| Semgrep | LGPL-2.1-only | Linux, macOS, Windows | Free / Commercial | Profile→ |
| Snyk | Proprietary (platform); Apache-2.0 (Snyk CLI) | Linux, macOS, Windows | Freemium | Profile→ |
| SonarQube | LGPL-3.0-or-later (source); Sonar Source-Available License v1.0 (bundled analyzers) | Linux, macOS, Windows | Free / Commercial | Profile→ |
| TruffleHog | AGPL-3.0-only | Linux, macOS, Windows | Free / Commercial | Profile→ |
| ZAP | Apache-2.0 | Linux, Windows, macOS | Open Source | Profile→ |
Tools in Application Security (SAST/DAST/SCA)
Bandit
Open SourceSecurity linter from PyCQA that processes Python ASTs to find common vulnerability patterns and insecure library usages.
Burp Suite
Free / CommercialWeb vulnerability assessment platform and intercepting proxy suite for testing web applications, APIs, and access controls.
CodeQL
Free / CommercialSemantic code analysis engine that compiles source code into queryable databases to discover vulnerabilities with QL queries.
Dalfox
Open SourceXSS scanner and parameter mining tool that parses HTML responses, tests injection points, and reports cross-site scripting weaknesses.
Gitleaks
Open SourceLightweight open-source secret scanner for git repositories, CI/CD pipelines, and pre-commit hooks, detecting hardcoded API keys, tokens, and passwords.
gosec
Open SourceStatic security checker from SecureGo that inspects Go AST and SSA code representations to identify security flaws and bad practices.
Semgrep
Free / CommercialFast static analysis engine for codebases and CI/CD pipelines, matching syntactic patterns to find security vulnerabilities.
Snyk
FreemiumFreemium application security platform that scans source code, open-source dependencies, containers, and IaC for vulnerabilities and license issues.
SonarQube
Free / CommercialMulti-language static analysis and code quality platform with open-source Community Edition and commercial Server and Cloud editions for continuous inspection.
TruffleHog
Free / CommercialOpen-source and commercial secret scanner with verified credential detection across source code, cloud storage, CI/CD, and SaaS platforms.
ZAP
Open SourceOpen-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.
Frequently Asked Questions
What is Application Security (SAST/DAST/SCA)?→
Static and dynamic security testing tools that scan source code, compiled binaries, and live web endpoints for code defects and known CVEs.
What topics does the Application Security (SAST/DAST/SCA) category cover?→
Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Source Code Auditing, CI/CD Pipeline Security
About Application Security (SAST/DAST/SCA)
Application security tools scan source code, compiled binaries, and running web applications for vulnerabilities. The category includes static analysis tools (SAST) that parse code patterns and data flow without executing the program, dynamic analysis tools (DAST) that test live endpoints by sending crafted requests, and software composition analysis tools (SCA) that check declared dependencies against vulnerability databases. SAST tools catch issues like SQL injection, path traversal, and hardcoded secrets during development. DAST tools find runtime problems that static analysis misses, including misconfigured headers and authentication bypasses. SCA tools identify known CVEs in third-party libraries and container images. Modern SAST engines like Semgrep let teams write custom rules that match their internal coding standards, while DAST scanners like ZAP integrate into CI pipelines for continuous endpoint testing. The combination of all three approaches provides layered coverage: SAST catches issues early in development, SCA prevents vulnerable dependencies from shipping, and DAST validates running applications against real-world attack patterns.
Covered Topics & Disciplines
Related Security Categories
CSPM scanners, container and Kubernetes policy engines, and cloud configuration auditing tools.
Intercepting HTTP proxies, security assessment toolkits, and network exploitation frameworks.
SBOM generators, artifact signing tools, and dependency vulnerability scanners for software supply chain integrity.