There are 755 static-analysis tools. Only 42 are open-source security scanners.
If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. We parsed the public analysis-tools.dev catalog (MIT-licensed, 755 tools) to get an actual count instead of a vibe. Here's what fell out. TL;DR Of 755 static-analysis tools in the catalog, 86% are…
There are 755 static analysis tools in the catalog, but only 42 of them are open-source security scanners. This disparity is surprising, given that 86% of the tools are open source. The 42 security scanners are distributed across 21 programming languages, with Python, Go, Java, and JavaScript having the most. Languages like SQL, Shell, PowerShell, Dart, Elixir, Lua, R, Groovy, Clojure, and Haskell do not have any open-source security scanners.
This gap exists despite these languages being crucial for CI, production systems, and SQL injection attacks. The data used for this study is publicly available in a single JSON file on a MIT-repo, and the methodology for the analysis is also open-source for reproducibility.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
