Semgrep
Static analysis tool where rules are written as "code patterns" instead of AST graphs — $X.execute($SQL) matches SQL injection patterns in Python/JS/Go and more.
r2c (Facebook spinout), 2019, renamed to Semgrep in 2020. Open-source core + commercial platform (Semgrep AppSec Platform) with thousands of pre-written rules. Fast (seconds per repo), false-positive-tolerant.
The default for security SAST in modern CI/CD. Competitors: SonarQube (more "code smell" than security), CodeQL (GitHub, more powerful but steeper), Snyk Code.