SAST on every pull request and pre-commit
Codacy finds and fixes injection flaws, weak cryptography, broken authentication and hardcoded secrets, with merge gates and compliance evidence for your audit. Secure your code in minutes without pipeline steps.
Trusted by 15,000+ organizations and 200,000+ developers worldwide
Why engineering teams choose Codacy for SAST
Security checks on every PR
Connect GitHub, GitLab or Bitbucket and Codacy scans every pull request on its own infrastructure. Findings land on the PR as in-line comments, fix suggestions and merge gates that stop security issues from going to production. No CI/CD configuration needed.
Learn more about PR checks
Fix issues before code is committed
Catch and fix security flaws locally with the Codacy CLI and Agent Skills running inside Claude, Codex, Cursor, VSCode and JetBrains IDEs. Fix SAST issues up to 10x faster, before opening a PR.
Learn more about local analysis
Fewer false positives, less time spent on triage
Codacy flags and ignores false positives with a reason, so only real issues reach your team. Focus on what matters and keep an audit trail of anything that was ignored.
Learn more about false positive detection
Findings with deadlines, owners and evidence
Every security finding gets a remediation SLA assigned, with customizable due dates across four severity levels. Track what's overdue, get real-time alerts for new critical issues, and export the list when auditors ask.
Learn more about remediation SLAs
SAST, SCA and Code Quality in one subscription
Codacy unifies SAST, Dependency scanning (SCA), Secret detection, Infrastructure-as-code, code quality and code coverage in one platform. Stop juggling invoices and dashboards for separate security scanners and code review tools. Billed per developer, with unlimited lines of code.
See all features
What Codacy SAST catches
Rules from the most powerful open-source analyzers for 49 languages, kept up-to-date and built into a single integration. Turn rules on or off per repository, or auto-tune them to match your stack and coding standards.
22 security categories, from SQL injection to mass assignment
Findings are grouped by category, including command injection, XSS, CSRF, cryptography, authentication, insecure storage and file access, so you can see which risks keep coming back and where.
50+ open-source engines, managed for you
Opengrep, Trivy, Checkov and Bandit run inside Codacy. You get their rule sets without installing, configuring or upgrading them.
Hardcoded secrets flagged pre-commit
Catch passwords, API keys and tokens locally, before the code reaches version control. Gate anything that finds a way into a Pull Request.
18 languages, plus IaC
Security rules for Java, JavaScript, TypeScript, Python, Go, C#, C, C++, PHP, Ruby, Kotlin, Swift, Scala, Rust and more, plus Terraform, Kubernetes, Dockerfiles and GitHub Actions.
Rules for risks only your code has
Write custom rules for patterns specific to your codebase and roll them out across your repositories.
Low-noise by design
Codacy auto-tunes each repository's rules to match its stack and coding conventions to deliver real findings from day one, without a wall of false positives.
"Just last month, we managed to close 1,200 findings with Codacy. It helped us improve communication between security and development teams, and it's continuing to raise the bar for compliance."
Senior Security Engineer at a global CX software company with 1,400 developers
security findings closed in a single month
accuracy across 826 security findings
to onboard a repository and get its first scan
Who Codacy SAST is built for
Teams running a security scanner and a quality tool
For teams paying for SAST in one product and code quality in another, with two rule sets to keep in sync. Codacy runs both in one scan on every pull request, with one set of standards and one dashboard.
Teams that answer to auditors
For teams that need to show their code is scanned and issues get fixed on time. Severity-based deadlines, ignore reasons and exportable findings give you evidence for SOC 2, ISO 27001 or PCI DSS reviews. LOGEX presents its Codacy dashboards in yearly ISO 27001 audits.
Teams building with coding agents
For teams where much of the code comes from Claude Code, Codex or Cursor. The Codacy CLI checks the agent output against your security rules before commit, and the pull request gate catches what slips past.
SAST from the first prompt
to the last merge
The same security rules run at every step, and DAST covers what static analysis can't see.
AI Agent
Check generated code against your security rules
Editor
Flag injection flaws and secrets as you type
Git Repo
Hold back merges that add new security issues
Production
Test running apps and APIs with DAST
Run your first SAST scan in minutes
Full scan within minutes | Free trial for 14 days | No credit card required
Frequently asked questions
What does Codacy SAST detect?
Codacy finds insecure code patterns across 22 security categories, including SQL injection, command injection, XSS, CSRF, weak cryptography, broken authentication, insecure storage and file access. The same scan flags hardcoded passwords, API keys and tokens, and checks infrastructure-as-code files for misconfigurations. Each finding shows the rule that fired, why it matters and how to fix it.
Which languages does Codacy SAST support?
Security rules cover Apex, C, C#, C++, Elixir, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala, Shell, SQL, Swift and TypeScript, plus Terraform, Kubernetes, Dockerfiles, CloudFormation, Azure Resource Manager templates, Serverless Framework and GitHub Actions. Code quality analysis covers 49 languages and frameworks. See the full list in supported languages and tools.
Do I need to change my CI/CD pipeline?
No. Codacy is triggered by Git webhooks and scans on its own infrastructure, then reports back to the pull request as a status check. Merge gates block a PR once you make the Codacy check required in your branch protection settings. A few analyzers, such as Gosec and SpotBugs, run client-side; if you want them, you add the Codacy CLI to your pipeline.
How does Codacy keep false positives down?
Three ways. Codacy detects each repository's stack and flags rules that don't apply to it. On the Business plan, false positive detection triages security issues at every severity and explains the ones it thinks are false positives, so developers confirm or dismiss them in one step. And any issue you ignore keeps its reason, so the same finding doesn't come back and reviewers can see why it was closed.
Can Codacy fix vulnerabilities automatically?
In the IDE, the free Codacy extension passes findings to your AI assistant, which proposes the fix before you commit. Coding agents using Codacy Skills can run the Codacy CLI, read the findings and fix their own code. On pull requests, Codacy adds fix guidance next to each issue. A developer reviews every change before it merges.
Is my code used to train AI models?
No. Codacy uses enterprise instances of OpenAI and Google Gemini models, customer code is not used for training, and secrets are redacted before any snippet is sent to a model. The Codacy CLI analyzes code locally without sending it to Codacy.
Which plan includes SAST, and what does it cost?
The free Developer plan includes local SAST, SCA and secret scans in your IDE. The Team plan adds SAST on every commit and pull request, merge gates, code quality, coverage and SCA, from $18 per developer per month billed yearly ($21 monthly), for up to 30 developers, and is free for open source. The Business plan adds false positive detection, custom rules, daily CVE re-scans, DAST, container scanning and SSO. You can start a 14-day free trial with no credit card, or ask for a one-month guided Proof of Value for larger rollouts.
SAST on every pull request, with your rules from the first prompt.
See it on your code in minutes.
Full scan within minutes | Free trial for 14 days | No credit card required