Microsoft DevSkim
Microsoft DevSkim: A free, developer-focused source-code analyzer with IDE extensions and GitHub workflow support. Ranked #14 of 25 in Static Application Security Testing Software by our editors (7.4/10); pricing: Free plan; best for developers wanting free inline security guidance.
At a glance
- Editor score7.4 / 10
- PricingFree plan
- Best forDevelopers wanting free inline security guidance
- Free planYes
- Paid fromFree
- Analysis targetSource
- Facts checked22 Sep 2026
Where it wins
- Free open-source analysis for Windows, macOS, and Linux
- Inline findings in Visual Studio and Visual Studio Code
- Custom rules, remediation guidance, SARIF, and GitHub integrations
Where it doesn't
- Its verified scope is narrower than broader general SAST tools
- Requires self-hosted deployment and developer-managed workflows
- Focuses on source-code analysis rather than a wider security suite
Our verdict on Microsoft DevSkim
Microsoft DevSkim is an open-source framework for detecting security issues in source code during development and automated workflows. It is designed for developers who want inline security analysis in Visual Studio or Visual Studio Code, along with cross-platform command-line scanning through .NET. Its free plan and self-hosted deployment model suit teams seeking developer-facing checks without a commercial tier structure.
DevSkim fits development environments that already use Microsoft IDEs or GitHub workflows. The Visual Studio and Visual Studio Code extensions provide inline findings, while the command-line analyzer supports Windows, macOS, and Linux. GitHub Actions can run scans, and results can be published to GitHub Security Issues. Output is available in SARIF and text formats, helping connect findings with development and CI workflows. Built-in and custom rules, including JSONPath-, XPath-, and YmlPath-based rules, give teams control over how checks are defined.
The standout feature is its remediation-oriented feedback. Findings include information and remediation guidance, and rule fix-it records support more actionable correction workflows. Optional suppression allows teams to manage findings that do not fit their context. DevSkim is a strong choice for developers who want free inline source-code guidance, custom rule support, and GitHub-compatible automation. Teams seeking a broader SAST platform with a wider verified feature and integration scope should consider alternatives designed for more expansive application-security programs.
Your product? Our editors can test Microsoft DevSkim in depth and publish a review, labelled as paid · from $149/mo →
Microsoft DevSkim pricing
Microsoft DevSkim fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Analysis target | Source |
| Supported languages | Not verified |
| IDE support | Yes |
| CI/CD support | Yes |
| Deployment | Self-hosted |
| SCA included | Not verified |
| Fix guidance | Yes |
| Deployment | Self-hosted, Desktop |
| Platforms | Windows, macOS, Linux |
| Support | Docs |
| Built for | Solo, Small business, Mid-market (editorial estimate) |
| Integrations | 3 integrations: Visual Studio, Visual Studio Code, GitHub Actions |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 22 Sep 2026 |
Microsoft DevSkim integrations
Microsoft DevSkim lists 3 integrations on its own site.
- Visual Studio
- Visual Studio Code
- GitHub Actions
Alternatives to Microsoft DevSkim
- Semgrep CodeBroad SAST coverage with strong pull-request, IDE, CI/CD, and custom-rule support.9.2
- GitHub CodeQLA strong fit for GitHub teams that want customizable semantic code scanning.8.9
- Veracode Static AnalysisA broad cloud SAST service for enterprises securing mixed application targets.8.7
See all Microsoft DevSkim alternatives →
Also Ranked In
Microsoft DevSkim is ranked in 3 of our directories.
Used Microsoft DevSkim? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Microsoft DevSkim for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Microsoft DevSkim is listed in our Static Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/microsoft-devskim/"><img src="https://www.itechguides.com/best/badge/microsoft-devskim.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update