Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to carry out similar assignments.

So far I have come across the O2 Platform but the documentation is all over the place. Microsoft's FxCop is another tool I found but their reports are horrible and I'd like something that would give me a report which I could use to further carry out a manual inspection without having to pull out my hair trying to read output.

What recommendations do you have for carrying out a code review in terms of a quality scan, free / relatively low pricing for an independent contractor and good reporting?

share|improve this question
This question might end up as a 'list', which tends not to do well on IS.SE. I will point you to… – schroeder Dec 10 '12 at 16:57
The challenge is finding a SAST tool. In terms of general code review, I saw the Wikipedia list. One article I found was at:… but haven't found anything similar for C#. If there's a comparison between different SAST tools in terms of costs and quality especially for a small business or independent consultant, that would be great. – Epoch Win Dec 10 '12 at 19:12
I know it is an outdated question, but can you tell me if Static Application Security Testing(SAST) is same as Source Code analysis tool? Like the ones I am seeing here Are they just same thing but different names? – DoodleKana Aug 12 '14 at 22:24

SAST tools in general tend to be pretty expensive for on-site hosted solutions and for c# I'm not aware of many good free tools

One option you could look at is the on-demand style scanning that several of the tool vendors do, which is likely to be cheaper if you're doing a smaller number of scans and also is something you might be able to factor into the cost of your assessments.

Some options

share|improve this answer

Take a look at CAT.NET from Microsoft.

Its a snapin for visual studio that does static analysis on a number of different languages.

share|improve this answer
CAT.NET is interesting, but unfortunately it's not (AFAIK) maintained and there haven't been any updates in the last couple of years. – Rоry McCune Apr 19 '13 at 15:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.