Skip to content
THREATWIRE

Open Source Tools · Alternatives

Open-source alternatives to Veracode

Veracode is a commercial application security testing service with static analysis at its core. Open-source static analysers such as Semgrep (multi-language), Bandit (Python) and Gosec (Go) run locally or in CI.

Veracode is a commercial product by Veracode (official site). Category: Static code analysis (SAST).

Comparison

ToolLicenceStarsLast commitBest for
SemgrepLGPL-2.1-onlyOpen source17k5 days agoLightweight, pattern-based static analysis
gosecApache-2.0Open source9ktodaySecurity checker for Go source code
BanditApache-2.0Open source8.3k28 days agoSecurity linter for Python code

Open-source options

  • Semgrep

    Lightweight, pattern-based static analysis

    Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.

    Stars
    17k
    Forks
    1.1k
    Last commit
    5 days ago
    LGPL-2.1-onlyOpen sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One+1

  • gosec

    Security checker for Go source code

    Inspects Go source code through its AST and SSA representation to find security problems such as injection, weak crypto and unsafe file handling.

    Stars
    9k
    Forks
    722
    Last commit
    today
    Apache-2.0Open sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One

  • Bandit

    Security linter for Python code

    Static analyser from the PyCQA that builds an AST of each Python file and runs plugins to flag common security issues.

    Stars
    8.3k
    Forks
    862
    Last commit
    28 days ago
    Apache-2.0Open sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One

Product names are trademarks of their owners. ThreatWire is not affiliated with Veracode. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.