Amazon Q Developer security scanning

Vendor: Amazon Web Services · HQ: United States · Category: Code security · Security

Last verified 18 Oct 2026 · Added 18 Oct 2026 · 3 sources · How we verify

Visit official site (opens in new tab) Claim this listing

Vendor? Get your “Listed on Agent Index” badge

What it does

Amazon Q Developer can review a file, a git diff or a project for security and quality issues. AWS docs list SAST, secrets detection, IaC issues, code quality, deployment risks and software composition analysis, powered by generative AI and Amazon Q detectors. Some findings include a suggested in-IDE fix. AWS has announced end of support for Amazon Q Developer IDE plugins on 30 April 2027, pointing users to Kiro for similar IDE capabilities; console and other Q Developer surfaces remain documented separately. This listing is the security-scanning/review capability, not a dedicated AppSec platform.

Frameworks

No framework tags verified yet.

Pricing (as published)

Free Tier with monthly limits; Amazon Q Developer Pro is $19 per user/month on aws.amazon.com/q/developer/pricing. Security scanning is a capability of those tiers, not a separately priced SKU on that page.

India relevance

IDE/project scanning for vulnerabilities and secrets can support CERT-In-oriented secure development. AWS does not market a CERT-In module for this feature.

Tasks

appsecsastsecrets-detectionscaiacremediation

Sources

1. docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html (primary)
2. aws.amazon.com/blogs/devops/code-security-scanning-with-amazon-q-developer/
3. aws.amazon.com/q/developer/pricing/

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email sales@heritageservices.online. See our methodology.

Use-case comparisons

• AI code security agents — 12 verified listings (Application security scanning, suggested or automated code fixes, and pull-request security review)

Compare Amazon Q Developer security scanning with

• Aikido AI AutoFix vs Amazon Q Developer security scanning
• Amazon Q Developer security scanning vs Checkmarx One Assist
• Amazon Q Developer security scanning vs Claude Code security review
• Amazon Q Developer security scanning vs Codacy AI Reviewer
• Amazon Q Developer security scanning vs Cursor Bugbot
• Amazon Q Developer security scanning vs Devin
• Amazon Q Developer security scanning vs Factory Droids
• Amazon Q Developer security scanning vs GitHub Copilot Autofix
• Amazon Q Developer security scanning vs GitHub Copilot coding agent
• Amazon Q Developer security scanning vs GitLab Duo Vulnerability Resolution

Alternatives

• Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
• Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.
• Claude Code security review — Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
• Codacy AI Reviewer — Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.
• Cursor Bugbot — Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.
• Devin — Cognition’s autonomous coding agent. Listed here only for documented Snyk MCP/CLI scanning and SonarQube/Snyk/Checkmarx IDE plugins — not as a dedicated security product.

See all Amazon Q Developer security scanning alternatives →

Stay updated