Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Puma Scan review

Freemium#21 of 25 in Static Application Security Testing Software

C#-focused SAST with IDE diagnostics, configurable rules, and CI scanning.

6.7/10Editor score
Visit Puma Scan
Puma Scan6.7 Visit Puma Scan

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Puma Scan focuses on static application security testing for C# and .NET projects. Its analyzers surface vulnerabilities as IDE diagnostics or build warnings, making it a fit for developers who want security findings in their coding and build workflows. The free Community edition is an open-source project; paid options add professional extensions, reporting, and ways to run scans on build infrastructure. Teams working mainly in other programming languages should look for a broader SAST tool.

The plans separate individual developer use from centralized scanning. According to the vendor's pricing page, End User costs $299 per user per year and includes a Professional Visual Studio extension, email support, and vulnerability reporting. Server costs $4,999 per year for command-line scanning and build-server integration. Cloud CI Standard is $5,999 per year and Cloud CI Unlimited is $10,999 per year; both integrate Puma Scan into CI/CD pipelines. These subscriptions renew annually. A 30-day free trial is listed, with no card required. The individual tier is the clearest fit for developers seeking Visual Studio diagnostics, while the higher annual plans suit teams that need pipeline or build-server scanning.

Configuration is a notable strength: teams can adjust security rules, define tainted sources and cleanse methods, and suppress false positives. Findings can be exported in HTML, JSON, CSV, MSBuild, and VSO formats. The listed integrations include Visual Studio, VS Code, GitHub Actions, GitLab CI, and Azure DevOps; optional analysis of vulnerable open-source package references adds a dependency-checking angle alongside source analysis. Choose Puma Scan when C# coverage and workflow-level diagnostics are the priority. Its single-language focus makes it a less suitable choice for organizations that need one scanner across multiple languages.

Puma Scan pros and cons

  • Where it wins
    • Reports C# security findings as IDE diagnostics and build warnings
    • Configurable rules, tainted sources, and cleanse methods
    • Supports Visual Studio and CI/CD integrations
  • Where it doesn't
    • Language coverage is limited to C#
    • Paid End User licensing starts at $299 per user annually
    • Server and Cloud CI plans add substantial annual costs

Puma Scan fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update