Shellcheck is described as 'A simple tool for finding bugs in shell scripts' and is an app in the development category. There are more than 10 alternatives to Shellcheck for a variety of platforms, including Linux, Windows, Mac, Web-based and Visual Studio Code apps. The best Shellcheck alternative is SonarQube, which is both free and Open Source. Other great apps like Shellcheck are Cppcheck, Coverity Scan, VibeGuard and SlowQL.
SonarQube is an open source quality management platform, dedicated to continuously analyze and measure source code quality, from the portfolio to the method. Static code analysis is available in the "Community Edition" (free / open source) for:
Switzerland
Cppcheck is an static analysis tool for C/C++ code. Unlike C/C++ compilers and many other analysis tools it does not detect syntax errors in the code. Cppcheck primarily detects the types of bugs that the compilers normally do not detect.
Sweden
EU
Coverity Scan Static Analysis allows to find and fix defects in your Java, C/C++ or C# open source project for free.
SlowQL is a production-focused offline SQL static analyzer that catches security vulnerabilities, performance regressions, reliability issues, compliance risks, cost inefficiencies, and code quality problems before they reach production.
Canada
Deep static analysis, direct support from devs| C, C++, C#, Java, JavaScript, TypeScript, Go | Helping you ship calmer releases.
Kazakhstan
Semgrep is a fast, open-source, static analysis tool that excels at expressing code standards — without complicated queries — and surfacing bugs early at editor, commit, and CI time. Precise rules look like the code you’re searching; no more traversing abstract syntax trees or...
Flawfinder examines C/C++ source code and reports possible security weaknesses ("flaws'') sorted by risk level. It's very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public.
VCG is an automated code security review tool that handles C/C++, Java, C#, VB and PL/SQL. It has a few features that should hopefully make it useful to anyone conducting code security reviews, particularly where time is at a premium:
Apache Yetus is a collection of libraries and tools that enable contribution and release processes for software projects.
Liverpool Data Research Associates (LDRA) is a provider of software analysis, test and requirements traceability tools for the Public and Private sectors and a pioneer in static and dynamic software analysis.
United Kingdom
United States
Netherlands
