{
 "schemaVersion": 1,
 "generated": "2026-10-30",
 "dataLicense": "CC BY-SA 4.0",
 "license": "CC BY-SA 4.0",
 "notice": "Data from Open Source Everything (https://opensourceeverything.org), licensed CC BY-SA 4.0: use it freely, credit the site, link to the page, and share changes under the same license. Listings were drafted with AI assistance and are managed by the r/TrueOpenSource moderators; check a project's own page before relying on a fact.",
 "id": "code-security",
 "name": "Dependency and code security checks",
 "page": "https://opensourceeverything.org/g/code-security/",
 "category": "dev-ship",
 "categoryName": "Hosting, shipping & running code",
 "job": "Catching risky packages and leaked secrets before they ship",
 "closedApps": [
  "Snyk",
  "GitHub Advanced Security",
  "Socket"
 ],
 "coverage": "partial",
 "alternatives": [
  {
   "id": "trivy",
   "name": "Trivy",
   "page": "https://opensourceeverything.org/p/trivy/",
   "summary": "Trivy is a free tool that scans software, containers and servers for known security weaknesses, leaked passwords and risky settings. It is aimed mainly at programmers and IT staff who want to check their projects before release.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "Apache-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 38782,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/aquasecurity/trivy",
   "website": "https://trivy.dev",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "trivy",
   "rank": 1,
   "fit": "partial",
   "note": "Covers leaked secrets and package vulnerabilities; no code-level review or live package-behavior monitoring stated.",
   "why": "Does part of the job · Advanced setup",
   "score": 39.8
  },
  {
   "id": "osv-scanner",
   "name": "OSV-Scanner",
   "page": "https://opensourceeverything.org/p/osv-scanner/",
   "summary": "OSV-Scanner is a free tool that checks the software libraries a project depends on against a public list of known security problems. It is meant for programmers and security staff who want to find risky packages before they ship.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "Apache-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 11290,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/google/osv-scanner",
   "website": null,
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "osv-scanner",
   "rank": 2,
   "fit": "partial",
   "note": "Covers dependency vulnerabilities and licenses; leaked-secret checks not described.",
   "why": "Does part of the job · Advanced setup",
   "score": 36.7
  },
  {
   "id": "gitleaks",
   "name": "Gitleaks",
   "page": "https://opensourceeverything.org/p/gitleaks/",
   "summary": "Gitleaks is a tool that scans code, files and git history to find accidentally saved passwords, API keys and login tokens. It is aimed at programmers and IT teams who want to stop secrets from being shared or published.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "MIT",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 30408,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/gitleaks/gitleaks",
   "website": null,
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "gitleaks",
   "rank": 3,
   "fit": "partial",
   "note": "Finds leaked secrets only; does not check risky packages or dependencies.",
   "why": "Does part of the job · Advanced setup",
   "score": 34.9
  },
  {
   "id": "dependency-track",
   "name": "Dependency-Track",
   "page": "https://opensourceeverything.org/p/dependency-track/",
   "summary": "Dependency-Track is a web service that reads the parts lists (called SBOMs) of software projects and flags components with known security problems, so organizations can track and reduce risk in what they ship. It is aimed at security and IT teams who manage software built from many third-party pieces.",
   "kind": "self_hosted",
   "setup": "advanced",
   "setupWhy": "You run it on your own server (a computer you set up and keep running), or from the command line.",
   "platforms": [
    "server"
   ],
   "license": "Apache-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 4367,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/DependencyTrack/dependency-track",
   "website": "https://dependencytrack.org",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "dependency-track",
   "rank": 4,
   "fit": "partial",
   "note": "Checks packages for known vulnerabilities; no secret-leak scanning shown.",
   "why": "Does part of the job · Advanced setup",
   "score": 33.9
  },
  {
   "id": "grype",
   "name": "Grype",
   "page": "https://opensourceeverything.org/p/grype/",
   "summary": "Grype is a tool that scans container images, folders and software lists for known security weaknesses in the software packages they contain. It is aimed mainly at software developers and IT staff who want to check their software before release.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "Apache-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 13123,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/anchore/grype",
   "website": null,
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "grype",
   "rank": 5,
   "fit": "partial",
   "note": "Covers known package vulnerabilities; no secret-leak or code scanning stated.",
   "why": "Does part of the job · Advanced setup",
   "score": 32.4
  }
 ],
 "source": "https://opensourceeverything.org/g/code-security/",
 "group": "Dependency and code security checks",
 "replaces": [
  "Snyk",
  "GitHub Advanced Security",
  "Socket"
 ]
}