The best static analyzers, according to hackers
12 static analyzers were recommended on Hacker News between November 2025 and November 2026. We rank them by how many separate people recommend each one, and 3 earn the Hacker Approved badge.
Top picks
The three most recommended static analyzers with the badge. Each figure is one person. RecommendsCriticizes One comment
Static analysis for GitHub Actions security
Free static analyzer for GitHub Actions that catches security issues such as template injection. Critics say it produces many false positives.
Catches common C and C++ mistakes
Free C and C++ linter that catches common bugs and is widely recommended alongside sanitizers and compiler warnings. Critics say it struggles with lifetime checks and produces false positives.
Handles type definitions well
Free open-source static analysis tool for PHP that people say catches most issues before runtime and handles type definitions well.
All 12 static analyzers, ranked
Select a column heading to sort. Approval share is recommenders out of everyone who gave an opinion; the tick on each bar marks the 2 to 1 line the badge needs. Months counts the months, out of 13, in which someone recommended it.
| Rank | |||||||
|---|---|---|---|---|---|---|---|
| 1 | zizmor | 19 | 1 | 95% | 6 | — | Approved |
| Tied 2 | Semgrep | 14 | 10 | 58% | 7 | — | — |
| Tied 2 | clang-tidy | 14 | 4 | 78% | 6 | — | Approved |
| 4 | PHPStan | 11 | 0 | 100% | 7 | — | Approved |
| 5 | SonarQube | 10 | 13 | 43% | 6 | — | — |
| 6 | CodeQL | 9 | 10 | 47% | 3 | — | — |
| 7 | Coverity | 7 | 6 | 54% | 4 | — | — |
| Tied 8 | Roslyn analyzers | 6 | 0 | 100% | 5 | — | — |
| Tied 8 | NilAway by Uber | 6 | 0 | 100% | 5 | — | — |
| Tied 10 | Dialyzer | 5 | 6 | 45% | 4 | — | — |
| Tied 10 | Frama-C | 5 | 0 | 100% | 4 | — | — |
| Tied 10 | NullAway | 5 | 1 | 83% | 3 | — | — |
How we rank
Rank is the number of separate people who recommend a product in a Hacker News comment over the past year. Someone who praises the same static analyzer in five threads counts once.
The badge goes to static analyzers that at least 10 people recommend, with recommenders outnumbering critics at least 2 to 1, recommended in at least 4 of the 13 months.
Rankings are never for sale. We may earn a commission when you buy through our links. It never changes the order.