There are 755 static-analysis tools. Only 42 are open-source security scanners.

If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. W...