semgrep

Semgrep is a fast, open-source, static analysis tool for modern languages. With 2,000+ existing rules and simple-to-create custom ones, it finds the bugs that matter.

Semgrep can run anywhere: in CI, your editor, or the command-line. Plus, with dedicated infrastructure from Semgrep, it’s easy to deploy, manage, and monitor Semgrep at scale.