Application Security Tools
Application security tools and solutions for securing web applications, mobile apps, and software throughout the development lifecycle.
Browse 804 application security tools
USE CASES
A deliberately vulnerable Java web application designed for educational purposes to teach web application security concepts and common vulnerabilities.
Bearer CLI is a static application security testing tool that scans source code across multiple programming languages to identify and prioritize OWASP Top 10 and CWE Top 25 security vulnerabilities through data flow analysis.
A Nuxt 3 security module that automatically implements OWASP security patterns through HTTP headers, middleware, and various protection mechanisms including CSP, XSS validation, CORS, and CSRF protection.
An open-source dynamic analysis framework that intercepts and monitors API calls in Android applications using the Android Substrate framework.
AndroBugs Framework is an Android vulnerability analysis system that scans mobile applications for security vulnerabilities, missing best practices, and dangerous shell commands.
A Java-based API tool for programmatically searching and downloading Android applications from Google Play Store with Galaxy S3 device compatibility.
A brute-force protection middleware for express routes that rate-limits incoming requests.
Code to prevent a managed .NET debugger/profiler from working.
Web-based tool for browsing mobile applications sandbox and previewing SQLite databases.
SearchCode is an extensive code search engine that indexes 75 billion lines of code from millions of projects to help developers find coding examples and libraries.
A comprehensive toolkit for web application security testing, offering a range of products and solutions for identifying vulnerabilities and improving security posture.
APKiD is a tool that identifies compilers, packers, obfuscators, and other weird stuff in APK files.
Application Security Specializations
804 tools across 14 specializations · 251 free, 553 commercial
Static Application Security Testing
Static Application Security Testing (SAST) tools that analyze source code for vulnerabilities using taint and dataflow analysis during development.
Secrets Detection
Tools that find and scan for leaked secrets, credentials, API keys, and tokens hardcoded in source code, repositories, and CI/CD pipelines.
Software Composition Analysis
Software Composition Analysis (SCA) tools for identifying vulnerabilities and license risks in open source dependencies and third-party libraries, with SBOM generation.
Application Security Tools FAQ
Common questions about Application Security tools, selection guides, pricing, and comparisons.
SAST (Static Application Security Testing) analyzes source code without running the application, catching vulnerabilities early in development. DAST (Dynamic Application Security Testing) tests running applications by sending requests and analyzing responses, finding runtime vulnerabilities. IAST (Interactive Application Security Testing) combines both by instrumenting the application during testing, providing real-time analysis with lower false positive rates than SAST or DAST alone.
A mature AppSec program typically includes: SAST for code-level vulnerability detection, SCA for open-source dependency risks, DAST for runtime testing, API security for protecting endpoints, secure code training for developers, and ASPM to unify visibility across all these tools. Start with SCA and SAST as they catch the most common vulnerabilities earliest in the development lifecycle.
Shift-left security means integrating security testing earlier in the software development lifecycle, ideally at the coding and CI/CD stages rather than waiting for production deployment. This approach uses tools like SAST, SCA, and IDE security plugins to catch vulnerabilities before they reach production, reducing remediation cost by up to 100x compared to finding issues in production.
SCA focuses specifically on identifying vulnerabilities in third-party libraries, open-source components, and software dependencies your application uses. SAST analyzes your own source code for security flaws. Since modern applications are 70-90% open-source code, SCA is essential for catching vulnerabilities in components you did not write but are responsible for securing.
