Open Source SAST Options Language / framework Scanning tool C/C++ Flawfinder Go Gosec Java find-sec-bugs JavaScript ESLint .NET Security Code Scan Node.js NodeJsScan PHP Phan Phpcs-security-audit
Python bandit Ruby / Ruby on Rails brakeman Scala find-sec-bugs
Compiled from: GitLab, SANS, OWASP
Ref: https://cdn2.hubspot.net/hubfs/228391/Corporate/DevOps_Audit_Defense_Toolkit_v1.0.pdf