Horusec
Horusec: A free, self-hosted SAST tool for multilingual code and secret scanning. Ranked #7 of 25 in Static Application Security Testing Software by our editors (8.2/10); pricing: Free plan; best for open-source teams needing multilingual self-hosted scanning.
At a glance
- Editor score8.2 / 10
- PricingFree plan
- Best forOpen-source teams needing multilingual self-hosted scanning
- Free planYes
- Paid fromFree
- Analysis targetSource
- Facts checked22 Sep 2026
Where it wins
- Free, open-source scanning across 18 languages and configuration formats
- Detects exposed secrets and analyzes Git history
- Supports CLI, Docker, VS Code, CI/CD, and a vulnerability dashboard
Where it doesn't
- Self-hosted deployment requires teams to manage the environment
- Third-party integration coverage is limited
- An official deprecation issue creates long-term maintenance uncertainty
Our verdict on Horusec
Horusec is an open-source static application security testing tool from ZupIT for developers and DevSecOps teams. It analyzes source code across 18 listed programming languages and configuration formats, identifies security flaws and exposed secrets, and can inspect Git history. Its free model and Apache License 2.0 distribution make it a fit for open-source teams that want self-hosted scanning rather than a paid hosted service. Horusec supports macOS, Linux, Windows, and a Chrome extension, with source analysis as its primary target.
The feature set covers several stages of a development workflow. Teams can run analysis through the command-line interface, adjust scans with CLI options, execute the tool through Docker, and use the Visual Studio Code extension during development. CI/CD pipeline usage supports automated checks, while the optional web application provides vulnerability dashboards and management. The published capabilities also include SCA, alongside static source analysis, giving teams broader application security coverage than a code-only workflow. These options make Horusec more suitable for teams comfortable integrating security checks into existing development processes than for buyers seeking a fully managed setup.
Horusec’s main trade-off is operational and long-term certainty. Self-hosted deployment provides control but places environment management on the adopting team, and verified third-party integration coverage is limited. The public repository has recent releases, while an official issue titled “horusec is DEPRECATED!” raises uncertainty around future maintenance. Teams choosing Horusec should value open-source access, multilingual scanning, secret detection, and configurable execution enough to accept that uncertainty. Organizations prioritizing a broader integration ecosystem or clearer maintenance direction should consider an alternative.
Your product? Our editors can test Horusec in depth and publish a review, labelled as paid · from $149/mo →
Horusec pricing
Horusec fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Analysis target | Source |
| Supported languages | Not verified |
| IDE support | Yes |
| CI/CD support | Yes |
| Deployment | Self-hosted |
| SCA included | Yes |
| Fix guidance | Yes |
| Deployment | Self-hosted |
| Platforms | Web, Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 22 Sep 2026 |
Alternatives to Horusec
- Semgrep CodeBroad SAST coverage with strong pull-request, IDE, CI/CD, and custom-rule support.9.2
- GitHub CodeQLA strong fit for GitHub teams that want customizable semantic code scanning.8.9
- Veracode Static AnalysisA broad cloud SAST service for enterprises securing mixed application targets.8.7
See all Horusec alternatives →
Horusec vs the competition
- Horusec vs Semgrep Code
- Horusec vs GitHub CodeQL
- Horusec vs Veracode Static Analysis
- Horusec vs Black Duck Coverity
- Horusec vs CodeSonar
- Horusec vs Klocwork
Compare Horusec with any tool side by side →
Also Ranked In
Horusec is ranked in 3 of our directories.
Used Horusec? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Horusec for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Horusec is listed in our Static Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/horusec/"><img src="https://www.itechguides.com/best/badge/horusec.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update