Semgrep

Code security platform combining static analysis, dependency scanning, and secrets detection.

Semgrep grew from an open source static analysis engine into a platform covering SAST, software composition analysis, and secrets scanning. Its rules read like the code they match, so engineers can write and tune them, and findings adapt to a codebase over time. Popular with teams that want application security developers will accept.