Code & dependency security

Tools that read source or package manifests: SAST, software composition analysis, and secret detection. Useful once the project is a real git repo, which not every builder project is on day one.

6 tools

Aikido
Code & dependency security
Security platform that looks across code, cloud, and runtime and tries to open fixes, aimed at teams that do not want five separate scanners.
Pricing as seen: See site.
CodeSonar
Code & dependency security
Deep static analysis for C, C++, and other languages, sold for enterprise and safety-critical software. Now offered by AdaCore.
Pricing as seen: Enterprise licensing. See site.
GitHub Advanced Security
Code & dependency security
GitHub’s own code scanning, secret scanning, and dependency features for repositories hosted on GitHub.
Pricing as seen: See site. Availability depends on your GitHub plan and whether the repository is public.
Semgrep
Code & dependency security
App security platform that combines custom and built-in rules for SAST, dependencies, secrets, and supply-chain checks in CI and the editor.
Pricing as seen: See site.
Snyk
Code & dependency security
Security platform for the code AI writes, open-source dependencies, containers, and cloud configuration, with hooks into coding agents.
Pricing as seen: See site.
Socket
Code & dependency security
Scans open-source packages for malicious behavior and blocks risky dependencies before they are installed or merged.
Pricing as seen: See site.