The best free alternative to Coverity Scan is SonarQube, which is also Open Source. If that doesn't suit you, our users have ranked more than 10 alternatives to Coverity Scan and 14 is free so hopefully you can find a suitable replacement. Other interesting free alternatives to Coverity Scan are Shellcheck, Cppcheck, SlowQL and Flawfinder.
SonarQube is an open source quality management platform, dedicated to continuously analyze and measure source code quality, from the portfolio to the method. Static code analysis is available in the "Community Edition" (free / open source) for:
Cppcheck is an static analysis tool for C/C++ code. Unlike C/C++ compilers and many other analysis tools it does not detect syntax errors in the code. Cppcheck primarily detects the types of bugs that the compilers normally do not detect.
SlowQL is a production-focused offline SQL static analyzer that catches security vulnerabilities, performance regressions, reliability issues, compliance risks, cost inefficiencies, and code quality problems before they reach production.
Flawfinder examines C/C++ source code and reports possible security weaknesses ("flaws'') sorted by risk level. It's very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public.
The Clang Static Analyzer is a source code analysis tool that finds bugs in C, C++, and Objective-C programs.
Facebook Infer is a static analysis tool - if you give Infer some Objective-C, Java, or C code, it produces a list of potential bugs.
Semgrep is a fast, open-source, static analysis tool that excels at expressing code standards — without complicated queries — and surfacing bugs early at editor, commit, and CI time. Precise rules look like the code you’re searching; no more traversing abstract syntax trees or...
Go from prototype to production with AI-driven code quality, security, compliance, orchestration, testing and documentation.
We’re excited to introduce Opengrep, an open-source static code analysis engine built to ensure code security testing remains truly open and accessible to everyone. 🚀
Switzerland
Norway
Sweden
EU
Canada
United States
