Semgrep

Semgrep is a fast, open-source static analysis engine that finds bugs and enforces code standards using a syntax that looks like the code you are searching.

Semgrep (formerly sgrep) delivers lightweight static analysis by matching patterns against source code without a build step. It supports 30+ languages (including Python, Go, and Java) and plugs into CI/CD pipelines like GitHub Actions to block vulnerabilities at the pull request. Security teams leverage 2,000+ community rules to flag OWASP Top 10 risks, while developers create custom rules in minutes using simple code snippets. It provides a high-speed alternative to legacy SAST: scanning thousands of lines per second to keep development moving.

https://semgrep.dev