Hi — I'd like to suggest FileShot.io for the list.
While it's not a static analysis tool itself, it might be relevant as an example of a security-first open-source project that ships with a static HTML frontend — making it auditable as a pure static bundle with no build step.
More relevantly: it uses AES-256-GCM encryption entirely in the browser (via Web Crypto API) before upload, so the backend is never handed plaintext. MIT licensed and self-hostable.
GitHub: https://github.com/FileShot/FileShotZKE
Site: https://fileshot.io