SAST tools › Open-source SAST tools

Open-source SAST tools: ten free scanners and their licenses

The best free start is one multi-language engine, Semgrep Community Edition or its fork Opengrep, plus the scanner built for your main language: Bandit for Python, gosec for Go, SpotBugs with Find Security Bugs for Java. Read the license before relying on two famous ones: CodeQL is free only for open-source code, and Brakeman needs a paid license if you sell it as a service.

Licenses and latest releases read from each project on November 13, 2026.

Ten free SAST tools compared

Datadog SAIST is the odd one out: instead of rules it sends your code to a model from Anthropic, OpenAI or Google using your own API key, and writes a SARIF report. It is in preview. AI SAST covers that approach and its trade-offs.

Semgrep CE or Opengrep?

Opengrep is a fork of Semgrep Community Edition. It says it was created when Semgrep moved critical features behind a commercial license, and it is backed by a group of security vendors, Aikido, Endor Labs and Orca Security among them, that pay for or lend its engineers. The difference that matters: Semgrep's own docs put cross-file and cross-function analysis in Semgrep Code, its proprietary platform (free up to 10 contributors), not in CE, while Opengrep ships cross-function and cross-file taint tracking in the open-source engine. Opengrep also ships signed binaries for Windows, reads Semgrep rules, and released version 2.0.0 on November 13, 2026.

Rules are the catch for both. Semgrep's registry rules are under the Semgrep Rules License, which allows them for your own internal business only, not for redistribution or a service. Opengrep's fork of the rules, taken on December 13, 2024, is archived. For scanning your own code at work, either engine with the registry rules is fine.

How much do pattern rules catch? When Winding AI ran Semgrep CE's free default rules on 13 real pull requests with 18 known security issues, they matched one exactly and flagged a second under a different name, and missed every logic and authorization flaw. Free rules are a floor, not a review.

A starter set per language

Each step is free and runs in any CI. Add one at a time and fail the build only on high-severity findings at first, so the team doesn't learn to ignore it.

1. Python: bandit -r src/, plus Semgrep CE or Opengrep.
2. Go: gosec ./..., which reads Go's syntax tree and SSA form.
3. Java or Kotlin: SpotBugs with the Find Security Bugs plugin in the Maven or Gradle build.
4. Rails: Brakeman, run from the app's root; free as long as you're scanning your own app.
5. JavaScript or TypeScript: Semgrep CE or Opengrep, plus eslint-plugin-security if your Node.js code already runs through ESLint.
6. Several languages and a dashboard: SonarQube Community Build on your own server, or SonarQube Cloud, free for private projects up to 50,000 lines of code.
7. Public repo on GitHub: turn on CodeQL code scanning, which is free there.
8. Dependencies: none of these check packages; add Dependabot or OSV-Scanner (see SAST vs SCA).

When free hosted beats self-run

Running scanners yourself costs CI minutes and someone's time to triage. Several hosted products are free at small sizes: Semgrep's platform up to 10 contributors and 10 repositories, with its cross-file Pro rules; Snyk Code at 100 tests a month; Aikido for 2 users; and SonarQube Cloud as above. Past those limits, see GitHub Advanced Security pricing for the most common next step.

Where IonWarp fits

IonWarp is not open source and not a rules-based scanner. It is an AI pull-request reviewer for GitHub only, whose Security Review reads the diff of pull requests that touch auth, input, data access or secrets. Its Starter plan is free for 3 seats, with about 70 reviews to start and about 25 a month after. On its own 13-PR security benchmark the default model found 10 of 18 known issues, against Qodo's 11; that is a small sample. It does no dependency scanning and doesn't scan the whole codebase, so run it next to the scanners above, not instead of them. Visit IonWarp

Questions

Is there an open-source alternative to SonarQube?

SonarQube has its own open-source edition, SonarQube Community Build, under LGPL-3.0, covering 21 languages but without taint analysis. For security findings specifically, Semgrep Community Edition or Opengrep plus a language scanner such as Bandit, gosec or SpotBugs with Find Security Bugs covers more. For a hosted free option, SonarQube Cloud is free for private projects up to 50,000 lines of code.

Is CodeQL free?

Only for open-source code and academic research. The CodeQL queries are MIT-licensed, but the CodeQL CLI's terms forbid using it on code that isn't under an OSI-approved license, such as a private repository, unless you pay for GitHub Advanced Security. GitHub Code Security is $30 per active committer a month.

Should I use Semgrep CE or Opengrep?

Opengrep, if you want cross-function and cross-file taint tracking without paying: it is an LGPL-2.1 fork of Semgrep CE that added it to the open-source engine. Semgrep CE, if you expect to move to Semgrep's platform later, which adds that analysis plus Pro rules. Opengrep reads Semgrep rules, so switching either way is cheap.

Related

• GitHub Advanced Security pricing What CodeQL costs on private repositories.
• AI SAST Model-based scanners, Datadog SAIST among them, and how they compare with rules.

About this page

Published by Winding AI, Inc., the company that makes IonWarp, an AI pull-request reviewer. We earn nothing from links to other tools; links to IonWarp carry a tag so IonWarp can count visits from this site. Visits are counted with Google Analytics. If a license or fact here is wrong, write to support@winding.ai.