Open alternatives5
Trivy is a free tool that scans software, containers and servers for known security weaknesses, leaked passwords and risky settings. It is aimed mainly at programmers and IT staff who want to check their projects before release.
Has 3 of 7
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
OSV-Scanner is a free tool that checks the software libraries a project depends on against a public list of known security problems. It is meant for programmers and security staff who want to find risky packages before they ship.
Has 2 of 7 · Finds leaked passwords and keys ✗ +1
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
Gitleaks is a tool that scans code, files and git history to find accidentally saved passwords, API keys and login tokens. It is aimed at programmers and IT teams who want to stop secrets from being shared or published.
Has 1 of 7 · Finds risky packages ✗ +1
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
Dependency-Track is a web service that reads the parts lists (called SBOMs) of software projects and flags components with known security problems, so organizations can track and reduce risk in what they ship. It is aimed at security and IT teams who manage software built from many third-party pieces.
Has 0 of 7
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
Grype is a tool that scans container images, folders and software lists for known security weaknesses in the software packages they contain. It is aimed mainly at software developers and IT staff who want to check their software before release.
Has 2 of 7 · Dashboard across projects ✗
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.