Best Free Security Tools

Free automated dependency updates and vulnerability alerts for all GitHub repos. Generates pull requests for updates across 30+ ecosystems (npm, pip, Maven, Go, Docker, etc.). Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Intense analysis of the configuration of any SSL web server. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (MIT) secret scanner for git repositories, files, and directories. CLI tool is free with no limits. GitHub Action free for personal repos and 1 org repo. Best for personal projects and open source projects and unlimited usage needs. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Monitor Java, Javascript, .NET, Scala, Ruby, and NodeJS projects for security vulnerabilities in dependencies. Free for one private project, unlimited projects for open source. Best for open source projects and unlimited usage needs. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

REST API for fetching information on data breaches. Free web search; API requires subscription for some endpoints. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

GitHub semantic code analysis engine. Free for all public repositories with no scan limits. Supports JS/TS, Python, Java, C#, C/C++, Go, Ruby. Integrated into GitHub Actions. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Find web app vulnerabilities, audit for OWASP Risks. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Sync your .env files, quickly & securely. Stop sharing your .env files over insecure channels like Slack and email, and never lose an important .env file again. Free for up to 3 teammates. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) web application security scanner. Passive/active scanning, AJAX spider, fuzzing, manual interception, CI/CD integration. No usage limits. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) multi-target vulnerability scanner for container images, filesystems, git repos, IaC, Kubernetes, SBOMs, and cloud resources. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Test an SSL/TLS service for secure server configuration, certificates, chains, etc. Not limited to HTTPS. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-28, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-28, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Free website security check and malware scanner. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Malware and URL analysis API (Google) — free community tier: 500 requests/day, 4 requests/minute. Scan files, URLs, domains, IPs against 70+ antivirus engines. Non-commercial use only. We could not read the page we cite for this offer when we last looked, on 2026-09-13, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 2 consecutive re-check attempts have failed (most recently 2026-09-13 — page content too short (likely JS-rendered SPA); a rendering client read 64 characters), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Helps implement privacy by design via audits and continuous workflows so that organizations comply with GDPR and other regulations. The free tier is limited to smaller teams and the SaaS version only. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) vulnerability scanner for container images and filesystems. Covers 20+ language ecosystems with daily-updated CVE database. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) IaC static analysis. Scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and 10+ frameworks for misconfigurations. No usage limits. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

A login security API to detect fraudulent and suspicious logins and notify your customers. Free for 1,000 logins per month. We could not read the page we cite for this offer when we last looked, on 2026-09-10, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 1 consecutive re-check attempt has failed (most recently 2026-09-10 — HTTP 403), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) secret scanner for git repos, Docker images, S3, Slack, and 20+ sources. Detects 800+ credential types with active API verification. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Scan your Django site for security flaws with this free, automated checkup tool. Forked from the Pony Checkup site. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

High confidence Indicator of Compromise(IOC) targeting public cloud infrastructure, A portion is available on github (https://github.com/unknownhad/AWSAttacks). Full list is available via API. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

HTTP security header testing tool. Now integrated into MDN as HTTP Observatory. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

A simple, intuitive web app for analyzing and decoding/encoding data without dealing with complex tools or programming languages. Like a Swiss army knife of cryptography & encryption. All features are free to use, with no limit. Open source if you wish to self-host. Best for open source projects and unlimited usage needs. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

All-in-one appsec platform covering SCA, SAST, CSPM, DAST, Secrets, IaC, Malware, Container scanning, EOL,... Free plan includes two users, scanning of 10 repos, 1 cloud, 2 containers & 1 domain. When we last read the page we cite for this offer, on 2026-08-29, we could read no amount, tier or rate on the page, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 2 consecutive re-check attempts have failed (most recently 2026-09-12 — The pricing page does not explicitly detail the features or limits of a free tier. It mentions starting for free with no credit card required, but does not specify the number of users, repos, clouds, containers, or domains included. Therefore, it's impossible to verify if the stored deal information is still accurate.), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Screen an order transaction for credit card payment fraud. This REST API will detect all possible fraud traits based on the input parameters of an order. The Free Micro plan has 500 transactions per month. Best for open source projects. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Cloud-first, developer-friendly security platform prevents data breaches in .NET and Java applications. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Test for modern Internet Standards like IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANE. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-09-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open Source CLI tool to prevent Kubernetes misconfigurations by ensuring that manifests and Helm charts follow best practices as well as your organization’s policies Best for open source projects. Its pricing page has not resolved for us since 2026-07-10, so we cannot confirm these terms today.

• −2 link_unreachable Datree's pricing page has not resolved for us since 2026-07-10.

Free, unlimited SCA scans for open-source projects. Detect and fix security threats before release. Protect your projects with a simple and effective solution. Best for unlimited usage needs. Its pricing page has not resolved for us since 2026-05-23, so we cannot confirm these terms today.

• −3 link_gone SOOS's pricing page has not resolved for us since 2026-05-23.