Static application security testing
Asked as “SAST tool”, and as “static code security scanner”, on behalf of a mid-market B2B company. 50 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
36%
Contested · SonarQube 22%
36Semgrep22SonarQube14Snyk Code28others
36% of first choices, contested.
Since September 2026▼−17Since September 2026: 47% → 30%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.Semgrep held the lead, −17 points on 47%, past the floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Semgrep53%Clear leader▼−20Since September 2026: 70% → 50%, −20 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →Mid-marketSemgrep36%Contested▼−17Since September 2026: 47% → 30%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.This pageEnterprise
Checkmarx One54%Clear leader▼−3Since September 2026: 54% → 51%, −3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →
Semgrep53%Clear leader▼−20Since September 2026: 70% → 50%, −20 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →Mid-marketSemgrep36%Contested▼−17Since September 2026: 47% → 30%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.This pageEnterpriseCheckmarx One54%Clear leader▼−3Since September 2026: 54% → 51%, −3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Semgrep36%5%63endorsed leader▼−17Since September 2026: 47% → 30%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.47% → 30%
Semgrep36%5%63endorsed leader▼−17Since September 2026: 47% → 30%, −17 points. Past the 11-point floor: movement. Read over the models both editions asked.47% → 30%02SonarQube22%18%62accepted challenger▲+1Since September 2026: 22% → 23%, +1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 23%
03
Snyk Code14%2%41accepted challenger▲+3Since September 2026: 13% → 16%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.13% → 16%
Snyk Code14%2%41accepted challenger▲+3Since September 2026: 13% → 16%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.13% → 16%04
Snyk8%9%11accepted challenger▲+2Since September 2026: 7% → 9%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 9%
Snyk8%9%11accepted challenger▲+2Since September 2026: 7% → 9%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 9%05CodeQL4%11%27accepted challenger▲+2Since September 2026: 2% → 5%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 5%
06
GitHub Advanced Security2%6%16accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
GitHub Advanced Security2%6%16accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%07
Veracode Static Analysis2%28%39criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%
Veracode Static Analysis2%28%39criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%08Checkmarx One2%45%44criticized challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Checkmarx One2%45%44criticized challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%Show the two products at 0%, ordered by negative rate
10
OpenText Fortify0%36%25criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
OpenText Fortify0%36%25criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%09Bandit0%13%15accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each
Semgrep vs CodeQLSemgrep vs GitHub Advanced SecuritySemgrep vs Veracode Static AnalysisSemgrep vs Checkmarx OneSonarQube vs Snyk CodeSonarQube vs SnykSonarQube vs CodeQLSonarQube vs GitHub Advanced SecuritySonarQube vs Veracode Static AnalysisSonarQube vs Checkmarx OneSnyk Code vs SnykSnyk Code vs CodeQLSnyk Code vs GitHub Advanced SecuritySnyk Code vs Veracode Static AnalysisSnyk Code vs Checkmarx OneSnyk vs CodeQLSnyk vs GitHub Advanced SecuritySnyk vs Veracode Static AnalysisSnyk vs Checkmarx OneCodeQL vs GitHub Advanced SecurityCodeQL vs Veracode Static AnalysisCodeQL vs Checkmarx OneGitHub Advanced Security vs Veracode Static AnalysisGitHub Advanced Security vs Checkmarx OneVeracode Static Analysis vs Checkmarx One
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01S02
0304C05
060708B09
10Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Semgrep36%
Semgrep36%02SonarQube22%
03Snyk Code14%
Snyk Code14%04Snyk8%
Snyk8%05CodeQL4%
06GitHub Advanced Security2%
GitHub Advanced Security2%07Veracode Static Analysis2%
Veracode Static Analysis2%08Checkmarx One2%
Checkmarx One2%09Bandit0%
10OpenText Fortify0%
OpenText Fortify0%What they warned about
Three of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, MiniMax M2.5 and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Checkmarx One45%
20 of 44 labels negative · 10 of 14 models · 1 hard negative
“What I'd Avoid for Mid-Market: Checkmarx and Veracode are powerful but typically start at $60K–$100K+/year” Kimi K2, paraphrase prompt
SonarQube
18%
11 of 62 labels negative · 9 of 14 models · 1 hard negative
“Noisiest out-of-box (40-60%+ FPs on Java/TS; OWASP F1-score ~27% in some evals)... avoid for security-only if you can't invest in config” Grok 4.1 Fast, negative prompt
Veracode Static Analysis28%
11 of 39 labels negative · 6 of 14 models · 1 hard negative
“What I'd Avoid for Mid-Market: Checkmarx and Veracode are powerful but typically start at $60K–$100K+/year” Kimi K2, paraphrase prompt
OpenText Fortify36%
9 of 25 labels negative · 6 of 14 models
“Fortify is described as heavyweight \u2013 requiring dedicated infrastructure and a team to manage scans and triage.” Muse Glimmer 30B, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
75 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 955 links across 194 sites, every framing counted. Ranked by the number of answers carrying the site or page. 16 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Checkmarx42 answers · 55 citations · 12 models
40 answers · 79 citations · 12 models
vendor site · Safeguard28 answers · 29 citations · 10 models
27 answers · 32 citations · 12 models
vendor site · Aikido25 answers · 32 citations · 10 models
vendor site · ZeroPath22 answers · 23 citations · 9 models
vendor site · Opsera21 answers · 21 citations · 11 models
vendor site · Augment Code20 answers · 23 citations · 8 models
vendor site · Corgea19 answers · 20 citations · 7 models
vendor site · OX18 answers · 22 citations · 10 models
vendor site · OWASP18 answers · 21 citations · 10 models
vendor site · Cycode18 answers · 21 citations · 10 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
37 answers · 11 models
25 answers · 10 models
21 answers · 9 models
21 answers · 11 models
17 answers · 10 models
17 answers · 10 models
17 answers · 10 models
16 answers · 8 models
14 answers · 7 models
12 answers · 7 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best sast tool”, “sast tool”, “sast tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days |
|---|---|---|---|---|---|---|---|
| Semgrep semgrep.dev | 36% | 194 | 8,100 | 191 | 3,461 | 43 | |
| Snyk snyk.io Snyk Code 14%, Snyk 8% | 22% | 143 | 12,100 | 581 | 61,651 company | 60 | |
| SonarQube | 22% | 14,800 | 1,353 | ||||
| CodeQL | 4% | 2,900 | 81 | ||||
| GitHub parent site GitHub Advanced Security 2% | 2% | 111 | 1,500,000 | 31,479 | |||
| Veracode Static Analysis veracode.com | 2% | 125 | 40 | 2 | 12,543 | 17 | |
| Aikido aikido.dev Aikido Security 2% | 2% | 342 | 2,400 | 51 | 6,442 company | $936 | 120 |
| DeepSource deepsource.com | 2% | 16 | 320 | 3 | 7,847 | 0 | |
| Semgrep Community/OSS | 2% | ||||||
| Semgrep's free tier | 2% |
Google's top ten for the three searches hold 24 sites; 4 of them are among the sites the models cited here (checkmarx.com, community.owasp.org, safeguard.sh, zeropath.com). The first result for “best sast tool” is reddit.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best SAST tool for a mid-market B2B company?”Paraphrase“Which static code security scanner would you recommend to a mid-sized B2B company?”Comparative“What are the top SAST tools and how do they differ?”Budget-constrained“What is the best SAST tool for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SAST tool. What should we look at?”Negative“Which SAST tools should I avoid or be cautious about?”
Claude Haiku 4.5no first choiceSnyk, SonarQubeChangedno first choiceSemgrepno first choiceagainst: Checkmarx One, Semgrep, Snyk, SonarQube, Veracode Static Analysis
Two alternatives
Qodana, SonarQubeGPT-5.4 miniSemgrepCodeQL, Snyk CodeChangedno first choiceagainst: SonarQubeSemgrep Community/OSSno first choicenothing named
Three alternatives
Checkmarx One, Snyk Code, Veracode Static AnalysisOne alternative
SonarQubeSeven alternatives
Black Duck Coverity, Checkmarx One SAST, CodeQL, GitHub Advanced Security, OpenText Fortify, Semgrep, Veracode Static AnalysisTwo alternatives
CodeQL via GitHub code scanning / GitHub Advanced Security, SonarQubeGemini 3.5 FlashAikido Securityagainst: OpenText Fortify, Veracode Static AnalysisSnykChangedagainst: GitHub Advanced SecuritySemgrep, Snyk CodeSemgrepagainst: CodeQLno first choiceagainst: Checkmarx One, CodeQL, OpenText Fortify, Veracode Static Analysis
Four alternatives
GitHub Advanced Security, GitLab SAST, Semgrep, Snyk CodeThree alternatives
GitLab SAST, Semgrep, SonarQubeFive alternatives
Black Duck, Checkmarx One, GitHub Advanced Security, SonarQube, Veracode Static AnalysisThree alternatives
Aikido Security, Snyk Code, SonarQubePerplexity SonarSemgrepSonarQubeChangedno first choiceSonarQubeno first choicenothing named
Two alternatives
Checkmarx One, Snyk CodeThree alternatives
Checkmarx One, OpenText Fortify, Veracode Static AnalysisTwo alternatives
CodeQL, SemgrepGrok 4.1 FastSnyk Codeagainst: Checkmarx OneSonarQubeChangedagainst: Checkmarx One, Veracode Static AnalysisCheckmarx Oneagainst: SonarQubeSemgrepno first choiceagainst: Checkmarx One, Flawfinder, HP Fortify, Insider, SonarQube, Veracode Static Analysis
Two alternatives
Semgrep, SonarQubeTwo alternatives
GitHub Advanced Security, Snyk CodeSix alternatives
Black Duck, CodeQL, OpenText Fortify, Semgrep, Snyk Code, Veracode Static AnalysisTwo alternatives
CodeQL, SonarQubeFive alternatives
Checkmarx One, Semgrep, Snyk Code, SonarQube, Veracode Static AnalysisMistral SmallSnykSemgrepChangedagainst: Checkmarx Oneno first choiceCodeQLno first choiceagainst: Checkmarx One, OpenText Fortifyagainst: SonarQube
Two alternatives
Aikido Security, SemgrepOne alternative
SonarQubeTwo alternatives
Semgrep, SonarQubeDeepSeek V4 FlashSnyk Codeagainst: Checkmarx OneSnyk CodeHeldagainst: Checkmarx One, Veracode Static AnalysisSemgrep, Snyk Codeagainst: Checkmarx OneSemgrepno first choiceagainst: CodeChecker, CodeQT, Contrast, CppChecker, Flawfinder, Graudit, Insider, JLint, Lapse+, PumaScan, RIPS, SonarQube, SpotBugs
Three alternatives
CodeAnt.ai, Semgrep, SonarQubeThree alternatives
CodeQL, Semgrep, SonarQubeSix alternatives
Black Duck Coverity, CodeQL, OpenText Fortify, Perforce Klocwork, SonarQube, Veracode Static AnalysisThree alternatives
CodeQL, Snyk Code, SonarQubeLlama 4 MaverickSnyk CodeCheckmarx One, Veracode Static AnalysisChangedno first choiceDeepSource, Semgrep's free tier, Snyk Code's Team plan, SonarQubeno first choicenothing named
Qwen 3.7 FlashSonarQubeSemgrep, SonarQubeChangedagainst: Checkmarx OneCheckmarx One, Snyk Codeagainst: SonarQubeSemgrepagainst: OpenText Fortifyno first choiceagainst: Bandit, Checkmarx One, ESLint, OpenText Fortify, SonarQube, Veracode Static Analysis
Two alternatives
Semgrep, Snyk CodeOne alternative
Veracode Static AnalysisThree alternatives
GitHub Advanced Security, OpenText Fortify, Veracode Static AnalysisTwo alternatives
CodeQL, SonarQubeKimi K2Semgrep, Snyk Codeagainst: Checkmarx One, Veracode Static AnalysisGitHub Advanced SecurityChangedagainst: Checkmarx One, Veracode Static AnalysisCheckmarx OneSemgrepSemgrepagainst: Checkmarx One, OpenText Fortify, Veracode Static Analysisagainst: Checkmarx One, Horusec, OpenText Fortify, Reshift, TSLint, Veracode Static Analysis
One alternative
SonarQubeTwo alternatives
Semgrep, SonarQubeSix alternatives
CodeQL, OpenText Fortify, Semgrep, Snyk Code, SonarQube, Veracode Static AnalysisFive alternatives
Bandit, Brakeman, CodeQL, SonarQube, gosecThree alternatives
Aikido Security, Snyk Code, ZeroPathGLM 4.7 FlashXSonarQubeSonarQubeHeldno first choiceSemgrepagainst: Codacyno first choiceagainst: Black Duck Coverity, Brakeman, Checkmarx One, Flawfinder, MobSF, NodeJS Analyzer, OpenText Fortify, Rational AppScan
Eight alternatives
Checkmarx One, Codacy, DeepSource, GitHub Advanced Security, OpenText Fortify, Semgrep, Snyk Code, Veracode Static AnalysisThree alternatives
Checkmarx One, DeepSource, SemgrepFive alternatives
Bandit, Brakeman, SonarQube, SpotBugs, gosecMiniMax M2.5SnykSnyk CodeChangedSemgrepSonarQubeagainst: Coverity Scan, FindBugs, PMDno first choiceagainst: Checkmarx One, SonarQube
Two alternatives
Semgrep, Veracode Static AnalysisThree alternatives
Checkmarx One, SonarQube, Veracode Static AnalysisFour alternatives
Checkmarx One, OpenText Fortify, Snyk Code, SonarQubeSix alternatives
Bandit, Brakeman, ESLint, GitHub Advanced Security, GitLab SAST, Snyk CodeGPT-6 LunaSemgrepSemgrepHeldSemgrepSemgrepno first choiceagainst: CodeQL, FindBugs, Semgrep, SonarQube
Two alternatives
GitHub Advanced Security, SnykTwo alternatives
CodeQL, Snyk CodeSeven alternatives
Black Duck Coverity, Checkmarx One, CodeQL, OpenText Fortify SAST, Snyk Code, SonarQube, Veracode Static AnalysisTwo alternatives
CodeQL, SonarQubeMuse Glimmer 30BSonarQubeagainst: Snyk CodeSemgrepChangedagainst: Checkmarx Oneno first choiceSemgrepno first choiceagainst: Bandit, Checkmarx One, OpenText Fortify, Semgrep, SonarQube
One alternative
SemgrepTwo alternatives
Snyk Code, SonarQubeEight alternatives
Black Duck Coverity, Checkmarx One, GitHub Advanced Security, OpenText Fortify, Semgrep, Snyk Code, SonarQube, Veracode Static AnalysisThree alternatives
Bandit, CodeQL, SonarQubeBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:09 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:01 | yes | 3 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:39 | yes | 16 | 28 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 07:56 | yes | 18 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:06 | yes | 20 | 7 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:52 | yes | 5 | 2 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:39 | yes | 19 | 25 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:39 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:20 | yes | 10 | 34 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:32 | yes | 17 | 25 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:56 | yes | 17 | 58 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:43 | yes | 5 | 17 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:07 | yes | 3 | 12 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:53 | yes | 14 | 26 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:29 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:04 | yes | 3 | 7 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:12 | yes | 14 | 24 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 08:53 | yes | 17 | 2 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:58 | yes | 21 | 7 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 07:52 | yes | 10 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:32 | yes | 24 | 31 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:04 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:46 | no | 0 | 39 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:31 | yes | 18 | 30 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:48 | yes | 22 | 73 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:32 | yes | 5 | 14 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:00 | yes | 3 | 18 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:56 | yes | 15 | 21 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:49 | yes | 10 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:33 | yes | 3 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:34 | yes | 15 | 28 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 08:56 | yes | 26 | 5 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 11:57 | yes | 23 | 8 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:36 | yes | 9 | 9 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:04 | yes | 24 | 33 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:26 | yes | 5 | 1 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:43 | yes | 9 | 19 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:00 | yes | 12 | 25 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:53 | yes | 10 | 33 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:48 | yes | 13 | 24 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:11 | yes | 9 | 28 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:53 | yes | 15 | 42 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:47 | yes | 9 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:41 | yes | 2 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:33 | yes | 14 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 09:20 | yes | 19 | 5 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:39 | yes | 18 | 7 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:00 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:43 | yes | 16 | 28 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:09 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:43 | yes | 5 | 24 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:40 | yes | 9 | 17 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:09 | yes | 13 | 29 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:36 | no | 0 | 48 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:14 | yes | 2 | 11 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:09 | yes | 12 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:26 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:32 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:40 | yes | 13 | 22 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 08:11 | yes | 20 | 6 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 11:39 | yes | 13 | 7 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 08:33 | no | 0 | 10 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:31 | yes | 20 | 54 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 09:39 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:27 | no | 0 | 27 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:27 | yes | 22 | 27 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:16 | yes | 14 | 53 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:35 | no | 0 | 9 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:34 | yes | 3 | 17 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:06 | yes | 13 | 21 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:07 | yes | 17 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:34 | yes | 4 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:51 | yes | 20 | 25 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 10:28 | yes | 18 | 4 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:20 | yes | 20 | 8 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:15 | yes | 5 | 4 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:44 | yes | 24 | 28 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:06 | yes | 5 | 1 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:33 | yes | 7 | 37 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:25 | yes | 23 | 30 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:17 | yes | 25 | 63 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:49 | yes | 14 | 29 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:29 | yes | 5 | 21 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:52 | yes | 24 | 51 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Checkmarx read as Checkmarx One
Checkmarx (Checkmarx One) read as Checkmarx One
GitHub Advanced Security / CodeQL read as GitHub Advanced Security
GitHub Code Security / CodeQL read as GitHub Advanced Security
GitLab read as GitLab SAST
GitLab Ultimate read as GitLab SAST
Veracode read as Veracode Static Analysis
Unresolved, counted raw
Checkmarx One SAST
CodeAnt.ai
CodeChecker
CodeQL via GitHub code scanning / GitHub Advanced Security
CodeQT
Coverity Scan
CppChecker
Find Security Bugs
Graudit
HP Fortify
Infer
Intrigue Core
JLint
Lapse+
NodeJS Analyzer
OpenText Fortify SAST
PumaScan
Rational AppScan (IBM)
Reshift
Semgrep Community/OSS
Semgrep's free tier
Snyk Code's Team plan
TSLint
Discontinued, still offered
No shut-down product was recommended here.