Best Free Security Tools

Monitor Java, Javascript, .NET, Scala, Ruby, and NodeJS projects for security vulnerabilities in dependencies. Free for one private project, unlimited projects for open source. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

High confidence Indicator of Compromise(IOC) targeting public cloud infrastructure, A portion is available on github (https://github.com/unknownhad/AWSAttacks). Full list is available via API. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Helps implement privacy by design via audits and continuous workflows so that organizations comply with GDPR and other regulations. The free tier is limited to smaller teams and the SaaS version only. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Scan your Django site for security flaws with this free, automated checkup tool. Forked from the Pony Checkup site. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (AGPL-3.0) secret scanner for git repos, Docker images, S3, Slack, and 20+ sources. Detects 800+ credential types with active API verification. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

REST API for fetching information on data breaches. Free web search; API requires subscription for some endpoints. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-11-02, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-11-02, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Find web app vulnerabilities, audit for OWASP Risks. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open Source CLI tool to prevent Kubernetes misconfigurations by ensuring that manifests and Helm charts follow best practices as well as your organization’s policies. We could not read the page we cite for this offer when we last looked, on 2026-11-10, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 13 consecutive re-check attempts have failed (most recently 2026-11-10 — fetch failed), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) multi-target vulnerability scanner for container images, filesystems, git repos, IaC, Kubernetes, SBOMs, and cloud resources. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) IaC static analysis. Scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and 10+ frameworks for misconfigurations. No usage limits. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

GitHub semantic code analysis engine. Free for all public repositories with no scan limits. Supports JS/TS, Python, Java, C#, C/C++, Go, Ruby. Integrated into GitHub Actions. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Free automated dependency updates and vulnerability alerts for all GitHub repos. Generates pull requests for updates across 30+ ecosystems (npm, pip, Maven, Go, Docker, etc.). The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) vulnerability scanner for container images and filesystems. Covers 20+ language ecosystems with daily-updated CVE database. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Intense analysis of the configuration of any SSL web server. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Test for modern Internet Standards like IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANE. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Cloud-first, developer-friendly security platform prevents data breaches in .NET and Java applications. When we last read the page we cite for this offer, on 2026-11-04, we found no earlier figure of ours for the page to have narrowed, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-11-04, found no earlier figure of ours for the page to have narrowed. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (Apache 2.0) web application security scanner. Passive/active scanning, AJAX spider, fuzzing, manual interception, CI/CD integration. No usage limits. The page we cite for this offer does not name it when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 1 consecutive re-check attempt has failed (most recently 2026-10-14 — the page never names OWASP ZAP and is not served from its domain), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

HTTP security header testing tool. Now integrated into MDN as HTTP Observatory. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

A simple, intuitive web app for analyzing and decoding/encoding data without dealing with complex tools or programming languages. Like a Swiss army knife of cryptography & encryption. All features are free to use, with no limit. Open source if you wish to self-host. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Free website security check and malware scanner. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Malware and URL analysis API (Google) — free community tier: 500 requests/day, 4 requests/minute. Scan files, URLs, domains, IPs against 70+ antivirus engines. Non-commercial use only. We could not read the page we cite for this offer when we last looked, on 2026-11-09, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 8 consecutive re-check attempts have failed (most recently 2026-11-09 — page content too short (likely JS-rendered SPA); a rendering client read 64 characters), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (MIT) secret scanner for git repositories, files, and directories. CLI tool is free with no limits. The GitHub Action needs no license key on personal accounts; repositories owned by a GitHub organization need a free license key from gitleaks.io. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-14, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Screen an order transaction for credit card payment fraud. This REST API will detect all possible fraud traits based on the input parameters of an order. The Free Micro plan has 500 transactions per month. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-10, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-10, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Code quality and security analysis, free for open-source projects and for private projects up to 50k lines of code: SonarSource lists the "SonarQube Team Plan, free for your private projects up to 50k LOC. No card, no expiry." 40+ languages and frameworks, CI/CD integration. Formerly SonarCloud.

• −1 stale_verification We cannot confirm this offer: 1 consecutive re-check attempt has failed (most recently 2026-11-08 — The pricing page text provided does not include the actual pricing/plans section or any mention of the free tier terms (50k LOC limit, open-source free, Team Plan details). It only shows navigation links to 'Pricing' and 'View plans' without the plan details themselves, so the stored deal info cannot be verified against this text.), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Test an SSL/TLS service for secure server configuration, certificates, chains, etc. Not limited to HTTPS. We could not read the page we cite for this offer when we last looked, on 2026-11-08, so we cannot confirm these terms today.

• −1 stale_verification We cannot confirm this offer: 1 consecutive re-check attempt has failed (most recently 2026-11-08 — HTTP 502), never confirmed since it was indexed. This is our inability to verify, not a change by the vendor. (a limit of ours, not a change by the vendor)

Sync your .env files, quickly & securely. Stop sharing your .env files over insecure channels like Slack and email, and never lose an important .env file again. Free for up to 3 teammates. The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-11, could read no amount, tier or rate on the page. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)

Open source (MIT) vulnerability scanner with YAML-based template system. 9,000+ community templates for web apps, APIs, networks, DNS, SSL. No usage limits. When we last read the page we cite for this offer, on 2026-10-24, we found the same terms as an earlier read we had declined to record, so we cannot confirm these terms today.

• −1 stale_verification Our last read of the vendor's pricing page, on 2026-10-24, found the same terms as an earlier read we had declined to record. This is our confidence in the record, not a change by the vendor. (a limit of ours, not a change by the vendor)