What's a good, developer-friendly static application security testing (SAST) tool for a primarily TypeScript codebase?

For a primarily TypeScript/JavaScript codebase, my default recommendation is semgrep.dev.

My shortlist

Why Semgrep: its rules are relatively easy for developers to understand and customize, it works well in PR/CI workflows, and current comparisons consistently rate it highly for developer-friendly SAST.

For TypeScript specifically, I'd value:

• Fast PR feedback — don't make developers wait several minutes for every scan.
• Actionable findings — point at the vulnerable code and explain the remediation.
• Framework awareness — particularly important with Express, NestJS, Next.js, React, etc.
• Easy custom rules — useful for enforcing your own security patterns.
• Low noise — probably the most important factor for developer adoption.

When I'd choose CodeQL instead

If you're already heavily invested in GitHub, I'd seriously consider codeql.github.com. It has dedicated JavaScript/TypeScript queries and is particularly strong at semantic and data-flow/taint analysis.

The tradeoff is that CodeQL is more sophisticated—and consequently less immediately approachable for writing your own queries.

What I'd deploy

For a reasonably mature TypeScript repo, I'd actually use:

Semgrep + CodeQL

• Semgrep: fast, developer-facing checks on every PR; custom organizational rules.
• CodeQL: deeper analysis, particularly for vulnerabilities involving data flow across files/functions.
• ESLint security rules: immediate local feedback for simple patterns.
• Dependabot/Snyk/etc.: dependency vulnerabilities, which aren't really SAST.

That division of labor gives you fast feedback without asking one scanner to do everything.

If you tell me GitHub vs GitLab, repo size, whether you're looking for free/open-source, and whether it's Node/Nest/Next/React/etc., I can narrow this to a specific recommendation and CI setup.

For a primarily TypeScript codebase, developer-friendly Static Application Security Testing (SAST) means tools that feel like linters: fast, precise, integrated into your IDE or pull requests, and low on false positives.

Here are the top developer-friendly SAST tools that shine with TypeScript:

• Semgrep: Widely loved by developers because it uses structural code search that understands code syntax (AST) rather than regular expressions. Writing or customizing rules feels like writing the code you're trying to catch. It runs exceptionally fast locally and in CI/CD, has native TypeScript support, and offers a generous open-source tier alongside its commercial platform.
• Snyk Code: Built explicitly with a developer-first mindset. It delivers real-time semantic analysis directly in your IDE as you type (powered by fast taint-tracking engines). Snyk matches your TypeScript patterns and suggests context-aware fixes inline, making remediation straightforward without leaving your workflow.
• GitHub Advanced Security (CodeQL): If your repositories already live on GitHub, CodeQL is a seamless choice. It offers some of the deepest data-flow and taint-analysis capabilities available for TypeScript/Node.js. Findings integrate right into the GitHub Pull Request interface (Code scanning ), allowing developers to triage alerts where they already review code.
• SonarQube: Excellent if you want to blend code quality metrics (bugs, code smells, maintainability) with security rules. SonarQube has robust TypeScript support that leverages your project's type information to reduce false positives compared to tools that treat TS like plain JS.

To help narrow down the best fit, tell me:

• Where is your code hosted (e.g., GitHub, GitLab, self-hosted)?
• Are you looking for a free/open-source tool or a commercial solution?
• Do you need it to run strictly in CI/CD pipelines or also provide real-time IDE feedback?

For a primarily TypeScript codebase, my first pick would be Semgrep.

My shortlist

1. Semgrep — my recommendation

Semgrep has first-class TypeScript/TSX support and is designed around fast, actionable findings that can run in the IDE, pre-commit, or CI. Its rules look much more like the source code you're matching than a traditional security-specific query language.

For a TypeScript team, that's particularly nice because you can write rules such as "don't call this dangerous API with user-controlled input" without having to learn a heavyweight analysis language.

Its current security offering also has cross-file/cross-function dataflow analysis, which is important for finding things like:

HTTP request
    ↓
controller
    ↓
service
    ↓
database/query/shell invocation

rather than merely identifying suspicious individual lines.

I'd choose it if: you want developers to actually use the tool, want fast PR feedback, and expect to create some organization-specific rules.

2. CodeQL — best if maximum analysis depth matters

GitHub CodeQL is the one I'd put ahead of Semgrep if your primary objective is finding subtle, multi-step vulnerabilities rather than maximizing developer ergonomics.

It has particularly strong TypeScript support: CodeQL can use TypeScript's static type information and perform data-flow analysis across JavaScript/TypeScript programs.

It also has a substantial built-in security query suite covering things such as XSS, redirects, sensitive-information handling, path traversal, etc.

The downside is that CodeQL feels more like a security-analysis platform than a developer linting tool. Custom queries have a steeper learning curve, and the analysis can be heavier.

I'd choose it if: you're on GitHub, have a serious AppSec program, and care more about analytical depth than minimal friction.

What I'd actually deploy

For a modern TypeScript application, I'd probably do:

                 ┌───────────────┐
                 │ TypeScript    │
                 │ application   │
                 └───────┬───────┘
                         │
             ┌───────────┴──────────┐
             ▼                      ▼
        Semgrep SAST             CodeQL
        every PR / IDE          scheduled/deep
             │                      │
             └──────────┬───────────┘
                        ▼
                 Security findings

But don't start with both unless you have a reason. I'd start with Semgrep, establish a low-noise developer workflow, and add CodeQL later if you need deeper variant/data-flow analysis.

One other important distinction: SAST won't cover your entire TypeScript security surface. I'd pair it with dependency/SCA scanning (npm audit, Dependabot, Renovate, or a dedicated SCA tool) and secret scanning.

Bottom line:

• 🥇 Semgrep — best overall developer-friendly choice for TypeScript.
• 🥈 CodeQL — best for deep security analysis, especially on GitHub.
• 🥉 SonarQube — attractive if you're already using it for general code quality, but I'd choose Semgrep/CodeQL for security-first SAST.

1. Semgrep — my recommendation

Semgrep has first-class TypeScript/TSX support and is designed around fast, actionable findings that can run in the IDE, pre-commit, or CI. Its rules look much more like the source code you're matching than a traditional security-specific query language.

For a TypeScript team, that's particularly nice because you can write rules such as "don't call this dangerous API with user-controlled input" without having to learn a heavyweight analysis language.

Its current security offering also has cross-file/cross-function dataflow analysis, which is important for finding things like:

HTTP request
    ↓
controller
    ↓
service
    ↓
database/query/shell invocation

rather than merely identifying suspicious individual lines.

I'd choose it if: you want developers to actually use the tool, want fast PR feedback, and expect to create some organization-specific rules.

2. CodeQL — best if maximum analysis depth matters

GitHub CodeQL is the one I'd put ahead of Semgrep if your primary objective is finding subtle, multi-step vulnerabilities rather than maximizing developer ergonomics.

It has particularly strong TypeScript support: CodeQL can use TypeScript's static type information and perform data-flow analysis across JavaScript/TypeScript programs.

It also has a substantial built-in security query suite covering things such as XSS, redirects, sensitive-information handling, path traversal, etc.

The downside is that CodeQL feels more like a security-analysis platform than a developer linting tool. Custom queries have a steeper learning curve, and the analysis can be heavier.

I'd choose it if: you're on GitHub, have a serious AppSec program, and care more about analytical depth than minimal friction.

What I'd actually deploy

For a modern TypeScript application, I'd probably do:

                 ┌───────────────┐
                 │ TypeScript    │
                 │ application   │
                 └───────┬───────┘
                         │
             ┌───────────┴──────────┐
             ▼                      ▼
        Semgrep SAST             CodeQL
        every PR / IDE          scheduled/deep
             │                      │
             └──────────┬───────────┘
                        ▼
                 Security findings

But don't start with both unless you have a reason. I'd start with Semgrep, establish a low-noise developer workflow, and add CodeQL later if you need deeper variant/data-flow analysis.

One other important distinction: SAST won't cover your entire TypeScript security surface. I'd pair it with dependency/SCA scanning (npm audit, Dependabot, Renovate, or a dedicated SCA tool) and secret scanning.

Bottom line:

• 🥇 Semgrep — best overall developer-friendly choice for TypeScript.
• 🥈 CodeQL — best for deep security analysis, especially on GitHub.
• 🥉 SonarQube — attractive if you're already using it for general code quality, but I'd choose Semgrep/CodeQL for security-first SAST.

For a primarily TypeScript codebase, "developer-friendly" usually means fast local feedback (IDE/CLI integration), low false-positive rates, and easy setup that doesn't feel like an enterprise tax.

The top choices tailored for TypeScript workflows stand out for distinct reasons:

• Semgrep : Best overall for developer velocity and custom rules. It uses AST-based structural pattern matching (writing rules looks like writing the code you're trying to catch), runs blazingly fast in CI and locally, and has an intuitive Semgrep Registry with solid TypeScript/Node defaults. It bridges the gap between linters and heavy SAST.
• Snyk Code : Best for a frictionless, developer-first experience. Snyk integrates tightly into VS Code/JetBrains and command lines, giving instant results as you type. Its engine is heavily optimized for modern web frameworks (Express, React, Next.js) and explains why a vulnerability exists with clear remediation advice.
• CodeQL : Best for deep, precise data-flow analysis. Built by GitHub, it treats your code like a database, allowing you to query complex taint-tracking vulnerabilities across files. It's heavier to configure if you want custom logic, but for open-source or GitHub-native pipelines, it's exceptionally powerful and free for public repos.
• ESLint Security Plugins : Best as an instant, zero-latency first line of defense. While technically a linter rather than a full SAST tool, running plugins like eslint-plugin-security right inside your IDE catches blatant injection risks or insecure patterns before you even commit.

If you share your team size and CI/CD environment (e.g., GitHub Actions, GitLab, local-only), I can help you narrow down the best fit and integration strategy.

For a TypeScript-heavy codebase, a "developer-friendly" SAST tool needs to be fast, low-noise, and capable of integrating natively into your IDE and pull request workflow without demanding a degree in security forensics.

The top developer-friendly options optimized for TypeScript vary by workflow and team preferences:

1. Semgrep (Semgrep Code / Semgrep OSS)
   • Best For: Fast, customizable scans and writing intuitive rules.
   • Why it's developer-friendly: Semgrep rules look like the actual code you are writing, making it trivial for TypeScript developers to read, modify, or write custom rules in plain YAML. It executes in seconds, meaning it won't bottleneck your CI/CD pipelines. You can try it out via Semgrep.
2. Snyk Code
   • Best For: Real-time, in-IDE feedback and unified security.
   • Why it's developer-friendly: Snyk is built from the ground up for developers. Snyk Code delivers lightning-fast semantic analysis directly inside VS Code or JetBrains, offering inline explanations and AI-assisted fix suggestions before you even push a commit. If you already use Snyk for open-source dependency scanning (SCA), adding Snyk Code keeps everything under one roof. Explore details on Snyk.
3. GitHub Advanced Security (CodeQL)
   • Best For: GitHub-native teams and deep data-flow analysis.
   • Why it's developer-friendly: If your team lives on GitHub, CodeQL integrates straight into your existing actions and security tabs. It treats code as data to run deep inter-procedural taint analysis, and it pairs smoothly with Copilot features to auto-suggest fixes directly inside PR workflows. It is entirely free for public repositories. Check out the setup via GitHub Advanced Security.
4. ESLint with Security Plugins (The Pre-Gate Baseline)
   • Best For: Zero-latency local linting and immediate feedback.
   • Why it's developer-friendly: While not a heavy enterprise SAST tool on its own, running typescript-eslint alongside plugins like eslint-plugin-security or eslint-plugin-no-unsanitized catches common injection and XSS patterns right in your editor and pre-commit hooks with zero pipeline lag. It’s the mandatory first layer of defense for any TS stack.

To help narrow down the ideal choice, tell me:

• Are you looking for a free/open-source tool or a commercial enterprise platform?
• Where do you primarily host your code and run CI/CD (GitHub, GitLab, Bitbucket, etc.)?

For a primarily TypeScript codebase, I’d shortlist Semgrep, GitHub CodeQL, and Snyk Code. The “best” choice depends less on raw detection and more on whether developers will actually run it, understand findings, and fix them.

My default recommendation: Semgrep

Best fit for most TypeScript teams.

Why it works well:

• Fast enough for every pull request.
• Good JavaScript/TypeScript support.
• Rules are approachable (YAML/pattern-based), so security-minded developers can add organization-specific checks.
• Good CI/CD and IDE workflows.
• Lower “security scanner fatigue” because you can tune the ruleset.

Typical setup:

• Run Semgrep on every PR.
• Start with a curated security ruleset.
• Add custom rules for your framework patterns (Express, NestJS, Next.js, internal libraries, etc.).

Tradeoff:

• The deepest cross-function/cross-file analysis is where tools like CodeQL can have an advantage.

---

Best if you are already on GitHub: GitHub Advanced Security (CodeQL)

Best for deeper vulnerability analysis.

Strengths:

• Strong semantic analysis and taint tracking.
• Excellent GitHub pull request integration.
• Good for finding vulnerabilities where data flows through several layers of code.

Tradeoffs:

• Slower feedback loop than lightweight scanners.
• Custom query development has a steeper learning curve.

A common mature setup is:

• Semgrep → every PR, fast feedback.
• CodeQL → scheduled scans / merge gates, deeper analysis.

---

Best commercial developer experience: Snyk (Snyk Code)

Good choice if you want:

• IDE-first workflows.
• PR comments with remediation guidance.
• SAST + dependency scanning in one platform.

Tradeoff:

• Cost can become significant as teams grow.

---

Where I’d put SonarQube

Good if your organization already cares about:

• code quality gates,
• maintainability,
• technical debt,
• security findings in the same dashboard.

I would not usually pick it as the only security scanner for a security-focused TypeScript application; I think of it more as a code-quality platform with security capabilities.

---

Practical TypeScript stack I’d deploy

For a modern web app (React/Next.js/NestJS/Node):

If I had to choose one for a TypeScript team starting today: Semgrep. If the repo is GitHub-native and you have security engineering support: Semgrep + CodeQL is a very strong combination.

A few details would change the recommendation:

• Is this a Next.js frontend, Node API, NestJS, or a monorepo?
• Are you looking for open source/free, or is a paid SaaS acceptable?
• Are you using GitHub Actions, GitLab CI, or something else?

For a primarily TypeScript codebase, I’d put developer experience first: fast feedback, low false-positive noise, good IDE/PR integration, and rules that match modern JS/TS frameworks. The best fit depends on your workflow, but these are the ones I’d shortlist.

My default recommendation:

Small-to-medium TypeScript team

Start with Semgrep. It is usually the easiest to get developers to actually use:

• Runs quickly enough on every pull request.
• Rules are readable and customizable.
• Works well for common TS/Node issues (unsafe APIs, injection patterns, auth mistakes, insecure crypto usage, etc.).
• Fits naturally alongside ESLint rather than replacing it.

Security-sensitive backend TypeScript (Node/Nest/Express APIs)

I’d pair:

1. Semgrep → every PR
2. CodeQL → scheduled/main-branch scans

They complement each other: Semgrep catches local patterns quickly; CodeQL is stronger at tracing flows like “untrusted HTTP input → database query” across files.

If you already use GitHub Advanced Security

Use CodeQL first. The integration is hard to beat:

• Findings appear in GitHub code scanning.
• Pull requests get security annotations.
• No separate AppSec platform to operate.

If developers complain about security tooling

Consider Snyk Code. It tends to win on “make engineers fix findings” because the workflow is polished and remediation-focused.

A practical TypeScript stack I’d deploy today:

• ESLint + TypeScript ESLint: fast local correctness checks
• Semgrep: PR security gate
• CodeQL: deeper scheduled analysis
• Dependabot/Renovate + SCA tool: dependency vulnerabilities
• Secret scanner (e.g., GitHub secret scanning or similar): because SAST generally won’t catch leaked tokens well

If you want just one tool: I’d choose Semgrep for most TS teams, or CodeQL if you’re already deeply invested in GitHub.

For a primarily TypeScript codebase, Semgrep is widely considered the best open-source, developer-first static application security testing (SAST) tool . It features a median scan time of roughly 20 seconds, yields exceptionally low noise and false-positive rates compared to traditional enterprise tools, and allows developers to write or tweak custom detection rules using simple YAML patterns.

Top developer-friendly SAST options for TypeScript vary by workflow preference:

• Semgrep : Best open-source and customizable tool . It natively parses TypeScript and JavaScript, runs instantly in CLI or CI/CD pipelines , and maps directly to the OWASP Top 10 and CWE Top 25.
• Snyk Code : Best for native IDE integration . It functions like a real-time spell checker inside VS Code or JetBrains, delivering sub-second feedback as you type TypeScript code with contextual fix guidance.
• Bearer CLI : Best for privacy-focused codebases . It runs locally from your command line and specializes in tracing sensitive data flows (PII) across TypeScript functions and files.
• GitHub CodeQL : Best for GitHub-native workflows . It treats your TypeScript code as a database, allowing deep semantic data-flow analysis directly inside GitHub pull requests.
• ESLint with typescript-eslint : Best lightweight baseline . While technically a linter rather than a dedicated security scanner , adding security-focused plugins (like eslint-plugin-security ) provides immediate, zero-friction feedback right in your build step.

If you can share whether you prefer a free/open-source CLI tool or a commercial platform with IDE plugins , and whether you deploy via GitHub Actions or another CI/CD pipeline, I can help you set up the configuration.

For a primarily TypeScript codebase, my default recommendation would be Semgrep—especially if “developer-friendly” means fast feedback, understandable findings, easy CI/PR integration, and the ability to tune rules without becoming a security specialist.

My shortlist

1. Semgrep — my pick

Semgrep is particularly pleasant for TypeScript/JavaScript because its rules are relatively approachable, scans can run directly in the developer workflow, and you can write organization-specific rules without needing to learn a heavyweight query language.

The big advantage is feedback quality over theoretical maximum coverage. Developers are much more likely to act on SAST findings if the tool can be run quickly and the finding explains what is wrong and how to fix it. Recent practitioner discussions also consistently highlight Semgrep's developer experience and tunability, although rule tuning is still important to avoid alert fatigue.

I'd use it for:

• PR/CI security gates
• detecting dangerous APIs and patterns
• framework-specific security rules
• custom rules for your application's security conventions
• fast local/pre-commit feedback

2. CodeQL — choose this for deeper analysis

If your repositories live on GitHub, CodeQL is probably the strongest alternative. It explicitly supports JavaScript/TypeScript, including cross-file analysis, and GitHub maintains substantial built-in security query suites for the language.

I'd favor CodeQL when your priority is:

"Find subtle vulnerabilities that require understanding how data flows through a relatively large application."

rather than:

"Give developers really fast, actionable feedback while they're coding."

There's also a nice GitHub-native workflow around pull requests and code scanning.

3. SonarQube — if security isn't the only goal

SonarQube makes more sense if you want SAST + general static code quality in one system: bugs, vulnerabilities, code smells, duplication, maintainability, etc.

It's a good organizational choice, but I'd generally choose Semgrep over it when the question is specifically "What SAST tool will developers actually enjoy using?" Current 2026 comparisons similarly put SonarQube toward the "security + quality gate" end of the spectrum.

What I'd actually deploy

For a modern TypeScript backend/frontend monorepo, I'd probably do:

Semgrep + GitHub CodeQL

rather than trying to make one tool do everything.

• Semgrep: fast developer/PR feedback and custom organization rules
• CodeQL: deeper periodic/CI analysis
• ESLint security rules: immediate editor feedback for obvious bad patterns
• Dependency scanner (e.g. Dependabot/Snyk): vulnerable npm dependencies

That combination also acknowledges an important limitation: SAST isn't a substitute for security review or runtime testing. Even strong static analyzers have blind spots, particularly around authorization/business-logic vulnerabilities. Recent research and benchmarking likewise show that no single SAST tool catches anything close to every real-world vulnerability.

Bottom line: If you want me to pick one, I'd start with Semgrep. If you're already deeply invested in GitHub and want maximum analysis depth, I'd pick CodeQL instead.

For a primarily TypeScript codebase, a developer-friendly static application security testing (SAST) tool needs to understand JavaScript/TypeScript idioms, parse frameworks like Express, NestJS, or React cleanly, run fast in pull request workflows, and avoid burying developers in noisy false positives.

The top, developer-friendly options well-suited for TypeScript include:

• Semgrep — Best for fast, transparent, and customizable scanning. Semgrep supports JavaScript/TypeScript natively using abstract syntax tree (AST) structural pattern matching rather than raw text regex . Its rules look remarkably like the code you are trying to find, meaning developers can read, tweak, or write custom YAML rules in minutes without learning an esoteric query language. Scans complete in seconds, fitting smoothly into pre-commit hooks or CI pull request gates. You can get started with the open-source engine or Semgrep CE and scale up to interprocedural cross-file taint tracking with their commercial tier.
• Snyk Code — Best for real-time IDE feedback and minimal friction. Powered by the DeepCode AI/ML engine, Snyk Code scans code as it is being written right inside VS Code, JetBrains, or Cursor. It provides inline fix suggestions and contextual remediation advice tailored for modern web frameworks like Next.js, Express, and React. It is exceptionally developer-friendly if your team wants an all-in-one ecosystem that bundles SAST alongside Software Composition Analysis (SCA) for npm dependencies and container scanning.
• GitHub Advanced Security (CodeQL) — Best for GitHub-native teams wanting deep semantic data-flow analysis. If your repositories already live on GitHub, CodeQL offers zero-friction setup and treats code as a queryable database to trace complex taint paths from source to sink across large call graphs. While writing custom queries has a steeper learning curve than Semgrep's YAML patterns, the default JS/TS query pack provided by GitHub is highly accurate and free for public repositories.
• ESLint Security Plugins — Best for instant, shifting-left feedback. While not a traditional standalone enterprise SAST platform, dropping security plugins (like eslint-plugin-security or framework-specific rules) straight into your standard ESLint config and IDE runner catches common Node/TS vulnerabilities before code even hits a commit hook. Many teams use this as a zero-cost first line of defense alongside a deeper CI scanner.

To help narrow down the best fit, tell me:

• Do you prefer a free/open-source tool or a commercial platform?
• Does your team need IDE-native feedback or primarily CI/CD pull-request checks?
• Are you looking to bundle dependency scanning (SCA) in the same tool?