SecureCodeReview.md

Open Source

• SonarQube
• YASCA

Paid

• Xanitizer

Open Source

SonarQube

SonarQube performs continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells and security vulnerabilities. It supports over 20 languages including JAVA, PHP, C#, Javascript, C/C++, COBOL, Python, Objective-C etc.

Also see Analyzing with Sonar-scanner

YASCA

Not supported, instead see Devskim

Paid

Xanitizer

As per the information on official website, By means of static code analysis the tool systematically scans the program code of an entire system for security vulnerabilities. Xanitizer investigates not only the source code, but also configuration files and templates for rendering the HTML output.