Open source
Open source tools for engineers at companies without a security team, one pick for each job. Every tool is under an open source license and free to use; where the project also sells a paid tier, it says so. Each tool's last commit, latest release, license, GitHub stars and OpenSSF Scorecard score are checked daily. Stars show how widely a tool is used, not that it is safe; the Scorecard score rates how the project protects its own code and releases.
Ransomware encrypts the backups it can reach. Keep an encrypted copy somewhere the server cannot delete, and test a restore.
restic/restic
Encrypted, deduplicated backups to a local disk, SFTP or S3-compatible storage. One binary.
Try it
restic init --repo /srv/backupborgbackup/borg
Encrypted, deduplicated backups over SSH, with append-only repositories a compromised client cannot erase.
Outside scans cannot see backported fixes. A package inventory from inside the server can, which is how you confirm a PHP or OpenSSL fix landed.
future-architect/vuls
Agentless vulnerability scanner for Linux and FreeBSD that reads the installed packages over SSH and matches them to advisories.
CISOfy/lynis
Audits a Linux or macOS host's configuration and lists concrete hardening steps. Runs from a git checkout with nothing to install.
Try it
cd lynis && ./lynis audit systemMost of the code you ship is someone else's. Check lockfiles against public advisories on every change.
google/osv-scanner
Reads lockfiles for npm, Composer, PyPI, Go, Maven and more, and matches them against the OSV.dev database.
Try it
osv-scanner scan source -r .A base image you pulled a year ago carries a year of unpatched packages.
anchore/grype
Scans a container image or a project directory for vulnerable packages.
Try it
grype alpine:latestaquasecurity/trivy
Finds vulnerable packages, leaked secrets and misconfigurations in images, file systems and IaC files.
Try it
trivy image python:3.4-alpineSecurity incident ·
Attackers with stolen project credentials published a malicious Trivy v0.69.4, malicious Docker Hub images v0.69.5 and v0.69.6, and rewrote the trivy-action and setup-trivy tags to steal CI secrets (CVE-2026-33634). v0.69.3 and earlier, trivy-action 0.35.0 and the Homebrew formula were not affected. If a pipeline ran an affected version, rotate the secrets it could read, and pin GitHub Actions to commit SHAs.
AdvisoryA fix only helps once you have upgraded to it. A bot that opens the upgrade pull requests keeps the gap short.
renovatebot/renovate
Opens pull requests that update dependencies, grouped and scheduled the way you configure. Works with GitHub, GitLab, Bitbucket and others.
A key deleted in a later commit is still in the history. Scan the whole history once, then every commit.
gitleaks/gitleaks
Scans git history, directories or stdin for secrets. Runs as a pre-commit hook or in CI.
Try it
gitleaks git -vtrufflesecurity/trufflehog
Finds secrets and checks whether each one still works, so you rotate the live ones first.
Try it
trufflehog git file://. --results=verifiedSQL built from strings, unescaped output and shell calls with user input are cheap to catch in review and expensive in production.
semgrep/semgrep
Pattern-based static analysis for over 30 languages. The free engine checks one file at a time; cross-file analysis is in the paid platform.
opengrep/opengrep
A community fork of Semgrep's engine, kept fully open source. Bring your own rules.
Try it
opengrep scan -f rules codeA workflow that runs untrusted input or an unpinned action can hand your deploy keys to anyone who opens a pull request.
zizmorcore/zizmor
Static analysis for GitHub Actions: template injection, unpinned actions, credential leaks and over-broad permissions.
Try it
zizmor .github/workflows/ossf/scorecard
Scores a repository's security practices, such as branch protection, pinned dependencies and signed releases. Also useful for judging a dependency.
Try it
scorecard --repo=github.com/ossf/scorecardRun it against your own staging site, never someone else's. A baseline scan only looks; an active scan sends attacks.
zaproxy/zaproxy
A web app scanner and intercepting proxy. The baseline scan reports missing headers, cookie flags and similar issues without attacking.
Try it
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.example.comprojectdiscovery/nuclei
Template-based scanner with community templates for known CVEs, exposed panels and misconfigurations.
Old protocol versions, weak ciphers and an incomplete certificate chain all show up from outside.
testssl/testssl.sh
Checks a server's protocols, ciphers, certificate chain and known TLS flaws. A shell script with no dependencies beyond bash and openssl.
Try it
docker run --rm -it ghcr.io/testssl/testssl.sh example.comnabla-c0d3/sslyze
A fast TLS scanner that can fail a CI job when a server drifts from the Mozilla configuration you choose.
An expired certificate takes a site down as surely as an attack, and it is announced weeks in advance.
louislam/uptime-kuma
A self-hosted status monitor for HTTP, TCP, DNS and more, with certificate expiry alerts to email, Slack and many other channels.
Try it
docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2TwiN/gatus
Health checks written as YAML conditions, including certificate expiry, with a status page.
Without SPF, DKIM and an enforced DMARC policy, anyone can send invoices that appear to come from you.
domainaware/checkdmarc
Validates a domain's SPF, DMARC, MX, MTA-STS and BIMI records and explains what is wrong.
Try it
checkdmarc example.comdomainaware/parsedmarc
Reads the DMARC reports mailbox providers send you, so you can see who sends as your domain before you enforce the policy.
Every public server sees password guessing within minutes of going online. Ban the sources automatically.
crowdsecurity/crowdsec
Reads your logs, detects attacks and blocks the sources at the firewall, web server or CDN, with an IP blocklist shared by its users.
fail2ban/fail2ban
The long-standing log watcher that bans IP addresses after repeated failures, for SSH, mail and web logins.
A WAF does not fix a vulnerable PHP build, but it filters common attacks while the fix is scheduled.
coreruleset/coreruleset
The standard open rule set for ModSecurity, Coraza and compatible firewalls, covering the OWASP Top Ten.
corazawaf/coraza
A WAF engine compatible with ModSecurity rules, available as a Caddy, Envoy or HAProxy plugin.
Shared logins end up in a spreadsheet or a chat thread. A team vault gives each person access to only what they need, and lets you revoke it.
dani-garcia/vaultwarden
A lightweight, unofficial server compatible with the Bitwarden apps and browser extensions, including organizations and sharing.
passbolt/passbolt_api
A self-hosted team password manager built around sharing, with per-item permissions.
An agent with a shell can run git reset --hard or rm -rf on the wrong directory, or read your .env file, in the time it takes to approve a prompt.
kenryu42/cc-safety-net
A hook that parses each command before an agent runs it and blocks destructive git and file system commands and reads of secrets. Supports Claude Code, Codex, Cursor and other coding CLIs.
Try it
npx -y cc-safety-net@latest install