Code scanning expands with third-party static analysis tools
Following last week's general availability of code scanning for open source and enterprise developers, GitHub has introduced 10 third-party tools that plug into the same workflow. These open source projects and commercial static application security testing (SAST) solutions integrate directly with GitHub code scanning, letting teams identify and fix vulnerabilities before they land in the code base.
The integrations are useful for organizations that have accumulated different scanning tools through acquisitions, need specialized coverage for areas like mobile, Salesforce, or mainframe development, or require custom reporting and dashboarding. They also give teams the option to keep their preferred tools while working through a single interface and API.
Under the hood, the code scanning API accepts results from third-party tools using the Static Analysis Results Interchange Format (SARIF), an open standard. A GitHub Action or GitHub App triggered by an event such as a pull request initiates a scan; the results are formatted as SARIF, uploaded to the GitHub Security Alerts tab, and aggregated per tool with duplicate alert tracking and suppression. The tools are available through the GitHub Marketplace or directly from the Security tab in a repository, where pre-configured workflows can be enabled.
Featured providers
Checkmarx
Checkmarx offers static and interactive application security testing, software composition analysis, and developer security awareness training. Its GitHub Action posts scan results to GitHub Issues, merge request overviews, or Security Alerts, and can pair findings with just-in-time training via Checkmarx Codebashing.
Codacy
Codacy performs automated code review covering static analysis, cyclomatic complexity, duplication, and unit test coverage changes on every commit and pull request. It enforces code quality standards and security best practices directly within GitHub repositories.
CodeScan
CodeScan is a static analysis solution purpose-built for the Salesforce platform. With more than 350 rules, it claims to have scanned over 21 billion lines of code since 2014 and targets the top tier of Salesforce enterprise customers.
DefenseCode ThunderScan
ThunderScan is a SAST solution that requires minimal user input and can run during or after development. Its REST API supports customized scanning at scale across multiple agents, and it helps meet compliance standards including PCI-DSS, OWASP Top 10, SANS/CWE Top 25, HIPAA, HITRUST, and NIST.
Fortify on Demand
Micro Focus's Fortify platform automates static, dynamic, interactive, and runtime security testing across the CI/CD pipeline. It is available on-premises or as a service for building an end-to-end software security assurance program.
Muse
Muse is a Continuous Assurance platform that applies a broad set of static analyzers at each pull request, adding comments directly in the code review process. It covers performance, reliability, security, and style issues, with particular strength in inter-procedural bugs. It is free on public repositories.
Secure Code Warrior
Secure Code Warrior provides security training to help developers write secure code from the outset. The goal is to improve security compliance and consistency while reducing the time and cost spent on bug finding and fixing.
ShiftLeft
ShiftLeft focuses on near-instantaneous security feedback during pull requests. Its open source tools available through GitHub Marketplace cover custom code, open source libraries, hard-coded secrets detection, and automated security workflows.
Synopsys Intelligent Security Scan
The Synopsys GitHub Action triggers optimized static analysis (SAST) and software composition analysis (SCA) scans through the Polaris DevSecOps platform. It runs the appropriate tests at the right time and surfaces filtered, prioritized results within the GitHub code scanning interface.
Veracode Static Analysis
Veracode delivers automated security feedback in the IDE and pipeline, with a full policy scan before deployment for compliance. The company says its SaaS-based engines have scanned 14 trillion lines of code, providing high-accuracy results without manual tuning.
Xanitizer
Xanitizer is a SAST tool from RIGS IT that performs data flow analysis and simulates common web application framework behavior to reduce false positives. It detects over 100 security problem types in Java, Scala, JavaScript, and TypeScript, and checks compliance with standards like OWASP Top 10 and CWE SANS Top 25.
