Application Security
SAST tools that name the sink in the PR (2026)
A 2026 shortlist of static analyzers that can comment on a pull request. Public docs, not a lab bake-off.
Expertise: Application Security · Level: Intermediate · 12 min read
A PDF from last quarter is not a review.
The sink is in the PR and the scanner still talks about ‘a vulnerability was found.’ SAST earns the row if it can name the file and the call. It is not SCA. The lockfile job lives on the supply-chain list.
Six analyzers. Two rule engines you can host. One GitHub-native query. One quality platform. One commercial PR bot. One Python specialist. Public docs and licenses. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Semgrep | Rules you can read in the PR | LGPL-2.1 (CLI) / commercial cloud |
| CodeQL | Query language on a GitHub repo | GitHub CodeQL license |
| Bearer | Data-flow SAST you can run locally | Elastic License 2.0 |
| SonarQube | Quality gate that includes security rules | LGPL-3.0 (Community) / commercial editions |
| Snyk Code | Commercial PR comments on the sink | Commercial |
| Bandit | Python AST checks you can run offline | Apache-2.0 |
Semgrep
Best for rules you can read in the PR
Semgrep matches code with a pattern that looks like the code. Rules are YAML. The CLI is open. Semgrep Cloud is paid.
Key features
- YAML rules that look like the sink
- OSS registry
- CI and PR comments
- You can write a rule in an hour
Why we like it
This is the hidden gem. A rule you can read is a rule you can fix. We prefer it over a black-box score.
Limits
You still write rules for your frameworks. Cloud features sit behind a contract. It is not a DAST.
CodeQL
Best for query language on a GitHub repo
CodeQL treats the repo as a database. Queries are QL. GitHub Actions can run it on public repos under GitHub’s terms.
Key features
- QL queries
- GitHub-hosted analysis
- Pack of security queries
- Results as SARIF
Why we like it
If the code is already on GitHub, this is the query shelf that can run without a second vendor.
Limits
The license is not Apache. Self-hosting has terms. QL is a language your team must learn.
Bearer
Best for data-flow SAST you can run locally
Bearer traces data to a sink. The CLI is open under ELv2. The product page still sells privacy and security findings.
Key features
- Data-flow traces
- CLI you can run in CI
- Language support listed in the repo
- JSON and SARIF
Why we like it
When the bug is ‘this email reached the logger,’ a regex SAST will miss it. Bearer is the open data-flow option on this list.
Limits
ELv2 is not OSI Apache. Language coverage is not every stack. You still review the trace.
SonarQube
Best for quality gate that includes security rules
SonarQube is the known quality platform. Security rules ship in the same gate as bugs and smells. Community is LGPL. Enterprise is paid.
Key features
- Quality gate in CI
- Security hotspot UI
- Many languages
- Self-host or SonarCloud
Why we like it
It is already in a lot of pipelines. We list it so the gem tools have a neighbor people recognize.
Limits
A hotspot is not always a sink. Edition splits hide rules. This is not a pentest.
Snyk Code
Best for commercial PR comments on the sink
Snyk Code is the SAST product next to Snyk Open Source. Findings land in the PR. The SCA job is a different list.
Key features
- PR annotation
- IDE plugin
- Snyk rule engine
- Same tenant as SCA if you already pay
Why we like it
If the org already bought Snyk for the lockfile, this is the SAST they will enable. We still want a Semgrep rule you can read.
Limits
Price is commercial. Rules are not a public YAML repo. We did not run a paid org.
Bandit
Best for python AST checks you can run offline
Bandit walks a Python AST. Tests have ids like B201. It is the language specialist on this list.
Key features
- AST tests with stable ids
- Config as YAML
- CI friendly
- Apache-2.0
Why we like it
A Python service that only needs Bandit should not wait for a platform RFP. The ids are greppable.
Limits
Python only. No data-flow across files the way Bearer claims. Framework sinks still need a test you enable.
What the internet thinks about SAST tools
Semgrep threads on HN keep landing on what a match actually proves. We agree. A clean scan is not a sink you tested.
da39a3ee on Hacker News, Apr 2021: “Since there’s no simple definition of what it’s doing, there’s no simple way to assess your false negative rate when searching for something.”
Prove Bandit runs on a file you own
On a host you own, run Bandit against an empty file. The command should start and exit clean on a fixture you control.
python3 -m pip install -q bandit
printf 'x = 1\n' > /tmp/bandit_fix.py
python3 -m bandit /tmp/bandit_fix.py; echo exit:$?FAQs
Is SAST the same as SCA?
No. SAST reads your code. SCA reads the lockfile. Supply chain owns the lockfile list.
Does a clean SAST mean the app is safe?
No. It means these rules did not fire. IDOR and authZ still need tests. Link the authorization list.
Should I run every tool?
No. Pick one rule engine you can write for, plus the platform you already pay for.
Is this a scored bake-off?
No. Order is editorial. We did not score true-positive rates in a lab.
