Compare 100+ free security tools — Snyk, Semgrep, CodeQL, GitGuardian, Trivy, Auth0, Clerk, and more. Exact free tier limits by security domain. Catalogue dates April to September 2026.
Security is no longer optional — even side projects get supply chain attacks, credential leaks, and dependency vulnerabilities. The good news: the security tool ecosystem has an unusually strong free tier landscape. Snyk offers free SAST scanning for up to 200 tests/month. Semgrep and CodeQL are free for open-source. Trivy and Grype are fully open-source container scanners.
This page compares every free security tool in our index — 103 tools across application security (SAST/DAST), secret scanning, dependency analysis, container security, identity/auth, error tracking, and SSL/compliance. Whether you need code scanning or user authentication, we have the comparison with exact free tier limits.
Looking for alternatives to a specific security tool? See our dedicated guide: Auth0 Alternatives
Static and dynamic analysis tools that find vulnerabilities in your code before they reach production. Ranges from cloud-hosted scanners like Snyk and SonarCloud to open-source engines like Semgrep and CodeQL.
Developer security — 200 open-source SCA tests/month, 100 SAST (Snyk Code) tests/month, 100 container tests/month, 300 IaC tests/month. Unlimited contributing developers. Code and dependency scanning across all products.
Code quality and security analysis — free and unlimited for open-source projects, 15+ languages, CI/CD integration. Formerly SonarCloud.
Open source license compliance and software composition analysis (SCA). Free tier: 5 projects, 10 contributing developers, 1 release group, 5 dependency levels, container scanning, SBOM export, API access
Static analysis (SAST) and software composition analysis (SCA) — Free Edition: Cross-file analysis with Pro rules, AI-powered detection, triage, and remediation, 60 AI credits included, Fast CI/CD deploy via Semgrep infrastructure, Scan up to 10 repositories, Maximum 10 contributors, Authentication via GitHub/GitLab
All-in-one appsec platform covering SCA, SAST, CSPM, DAST, Secrets, IaC, Malware, Container scanning, EOL,... Free plan includes two users, scanning of 10 repos, 1 cloud, 2 containers & 1 domain.When we last read the page we cite for this offer, on 2026-08-29, we could read no amount, tier or rate on the page, so we cannot confirm these terms today.
Free autonomous security platform that finds, validates and fixes insecure code and packages across +20 languages and frameworks. Free plan includes 10 repos, 10 PR scans/month, and 10 SAST auto fixes. Features: AI SAST, Logic/Auth Scanning, Dependency Scanning, Secrets Detection, Container Scanning, IaC Scanning.
Open Source CLI tool to prevent Kubernetes misconfigurations by ensuring that manifests and Helm charts follow best practices as well as your organization’s policiesIts pricing page has not resolved for us since 2026-07-10, so we cannot confirm these terms today.
Monitor Java, Javascript, .NET, Scala, Ruby, and NodeJS projects for security vulnerabilities in dependencies. Free for one private project, unlimited projects for open source.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Find web app vulnerabilities, audit for OWASP RisksThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free, unlimited SCA scans for open-source projects. Detect and fix security threats before release. Protect your projects with a simple and effective solution.Its pricing page has not resolved for us since 2026-05-23, so we cannot confirm these terms today.
Helps implement privacy by design via audits and continuous workflows so that organizations comply with GDPR and other regulations. The free tier is limited to smaller teams and the SaaS version only.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (Apache 2.0) IaC static analysis. Scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and 10+ frameworks for misconfigurations. No usage limits.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (Apache 2.0) web application security scanner. Passive/active scanning, AJAX spider, fuzzing, manual interception, CI/CD integration. No usage limits.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (MIT) vulnerability scanner with YAML-based template system. 9,000+ community templates for web apps, APIs, networks, DNS, SSL. No usage limits.When we last read the page we cite for this offer, on 2026-09-16, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
GitHub semantic code analysis engine. Free for all public repositories with no scan limits. Supports JS/TS, Python, Java, C#, C/C++, Go, Ruby. Integrated into GitHub Actions.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free plan with 5 scan hours/month for web application and API vulnerability scanning, up to 3 users, full API access. No credit card required.We could not read the page we cite for this offer when we last looked, on 2026-09-12, so we cannot confirm these terms today.
Hosted DAST for CI/CD, repositioned as a security platform for AI coding agents. No free tier. stackhawk.com/pricing, read 2026-09-20, publishes two plans: Wingman at $10 per user per month, covering unlimited apps and 50 agentic scans per user per month, and StackHawk Scale on request. The page states "unlimited apps — no per-app or per-scan math", so there is no per-app rate, and every occurrence of "free" on it names a 14-day trial.
Prevent credential leaks and manage secrets securely. GitGuardian catches secrets in commits, while Vault, Doppler, and Infisical provide runtime secret management with rotation and access controls.
Secrets management — up to 3 users, 10 projects, 4 environments per project. CLI, SDKs, and integrations included
Free tier includes 5 identities, unlimited projects, 100+ integrations, Secret Sharing, Secret References and Imports, Secret Overrides, 2FA.
Self-hosted free (BSL 1.1 license). HCP Vault Secrets cloud free tier: 25 apps, 25 static secrets, 5 versions, 5 syncsWe could not read the page we cite for this offer when we last looked, on 2026-09-26, so we cannot confirm these terms today.
Secrets detection for up to 25 developers — 420+ secret types, unlimited real-time scanning, 500 historical scan detections, CLI (ggshield) for pre-commit hooks, VSCode extension, 10K API calls/month
Cloud-first, developer-friendly security platform prevents data breaches in .NET and Java applicationsThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Sync your .env files, quickly & securely. Stop sharing your .env files over insecure channels like Slack and email, and never lose an important .env file again. Free for up to 3 teammates.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Secure Enterprise-grade platform for managing environment variables and secrets. Free tier includes up to 3 applications and 150 secrets per project.The page we cite for Smart Grow Vault states in words that it is free, which confirms the price — the limits stated here come from our own record rather than from that page.
Open source (MIT) secret scanner for git repositories, files, and directories. CLI tool is free with no limits. GitHub Action free for personal repos and 1 org repo.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (Apache 2.0) secret scanner for git repos, Docker images, S3, Slack, and 20+ sources. Detects 800+ credential types with active API verification.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Always Free: 6 active secret versions, 10K access operations/month, 3 rotation notifications/month. Centralized secrets storage with IAM-based access control
Automated dependency scanning, vulnerability alerts, and update management. These tools catch known CVEs in your dependency tree and can auto-create PRs to fix them.
Supply chain security for open source dependencies — Free: $0 per month, per developer. Unlimited developers & repos. 1,000 scans per month. 500 API quota per hour. 3 members, 1 repository label.
Open source (Apache 2.0) vulnerability scanner for container images and filesystems. Covers 20+ language ecosystems with daily-updated CVE database.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free automated dependency updates and vulnerability alerts for all GitHub repos. Generates pull requests for updates across 30+ ecosystems (npm, pip, Maven, Go, Docker, etc.).The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (AGPL-3.0) automated dependency update bot. Supports 90+ package managers. Available as self-hosted CLI or free hosted GitHub/GitLab App by Mend.The page we cite for Renovate names a plan but states no amount, so these limits come from our own record rather than from that page.
Scan container images for vulnerabilities, enforce Kubernetes policies, and secure network access. Most are open-source with no usage limits when self-hosted.
Zero trust network access — Starter plan is free and includes up to 5 users and up to 50 Resources.
Mesh VPN with WireGuard — 6 users, unlimited devices, MagicDNS, exit nodes, subnet routing. Free Personal plan.
High confidence Indicator of Compromise(IOC) targeting public cloud infrastructure, A portion is available on github (https://github.com/unknownhad/AWSAttacks). Full list is available via APIThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open source (Apache 2.0) multi-target vulnerability scanner for container images, filesystems, git repos, IaC, Kubernetes, SBOMs, and cloud resources.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
CNCF Graduated (Apache 2.0) runtime security tool. Monitors Linux syscalls and Kubernetes events to detect threats in containers, hosts, and cloud environments in real time.
User authentication, authorization, and identity management — from managed services like Auth0 and Clerk to self-hosted options like Keycloak and SuperTokens. Free tiers typically measured by monthly active users.
Drop-in auth with 50K monthly retained users free, unlimited apps
Identity platform — 25K MAU (B2C), unlimited logins, social + database connections, Universal Login, 1 Enterprise Connection, 5 Organizations, 1 Custom Domain. No credit card required
10,500 MAU, OAuth 2.0/OIDC/SAML, MFA (email/SMS/app), passwordless, multi-tenancy (5 organizations), feature flags (10 max). No credit card required
User Management is free for up to 1 million users. Single Sign-On starts at $125/connection. Directory Sync starts at $125/connection. Audit Logs are free with paid options for log streaming and event retention. Radar is free for the first 1,000 checks.
Authorization-as-a-service — Community plan, free forever: 1,000 MAU, 20 tenants, no limit on authorization queries, 25 roles, 50 resource types, 5 condition sets, 2,000 role assignments, 20 groups, 2,000 resource instances and 2,000 relationship tuples, with 3 environments and no limit on projects. All features are open to all tiers. Open-source projects can get the Startup tier free.The page we cite for Permit.io states in words that it is free, which confirms the price — the limits stated here come from our own record rather than from that page.
Authentication and fraud prevention — 10,000 MAU, passwordless login, OAuth, MFA, session management, device fingerprinting, 5 SSO/SCIM connections, 1,000 M2M tokens, password breach detection
Authentication and user management. Free Forever plan: 7,500 MAU, 10 tenants, 3 SSO connections. All core auth methods: passwords, magic links, OTP, passkeys, social login, MFA
Passkey-first authentication — The 'Starter' (Free) tier includes 10,000 MAUs and 2 Projects. A 'Startup Plan' offers 1 million MAUs. All tiers include 10,000 free monthly active users.
Free OSS (Apache 2.0). Red Hat-backed identity and access management. SSO, OIDC, SAML, LDAP, social login, MFA, fine-grained authorization. Self-hosted with no user limitsThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Identity platform — "FusionAuth Community is free and unlimited": self-host it on your own infrastructure, with the core authentication features and community support (forums, Slack, GitHub).
Open source authentication — Self hosting the open source features is free without any limits! Cloud is free under 5K MAUs. Multi-factor Authentication is $0.01 / MAU (Minimum $100 / month). Account Linking is $0.005 / MAU (Minimum $100 / month).
A free tool to search a username across 150+ social platforms to find matching profiles.
Fine-grained authorization as a service for applications and APIs. Free up to 1000 MAUs and 100 authorizer instances.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Seamless Integration of SSO, MFA, passwordless auth and more. Includes SDKs for frontend and backend apps. Free tier: 7,500 Consumer MAUs (B2C), 250 B2B MAUs, 2 social login providers.When we last read the page we cite for this offer, on 2026-09-17, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
Bring Passwordless, OTPs, 2FA, SSO to your apps in minutes. All Front-end included. Free tier: unlimited MAUs, up to 2 applications, 100 SMS/month.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
First 1000 billable calls are free. 0.0012 USD per call, billed monthly.
Two-factor authentication (2FA) on multiple devices, with backups. Drop-in replacement for Google Authenticator. Free for up to 100 successful authentications.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
A complete authorization management system for authoring, testing, and deploying access policies. Fine-grained authorization and access control, free up to 100 monthly active principals.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Keycloak Identity and Access Management as a Service. Free up to 100 users and one realm.
Two-factor authentication (2FA) for website or app. Free for ten users, all authentication methods, unlimited, integrations, hardware tokens.
Two-factor authentication (2FA) by push notifications, free for 3 users, VPN, Websites, and SSHThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Open-source identity solution — Free tier is $0/month for up to 50,000 MAU and 50K tokens. Includes user authentication, machine-to-machine apps, account APIs, audit logs, and user management. Additional features like RBAC, MFA, and Organizations are paid add-ons.
MojoAuth makes it easy to implement Passwordless authentication on your web, mobile, or any application in minutes. — Free up to 25,000 MAUs. No credit card required.
Developer authentication via Auth0 platform — 25,000 MAU free, social login, passwordless, MFA, SSO. Note: developer.okta.com/signup now routes to Auth0.When we last read the page we cite for this offer, on 2026-09-17, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
Open-source identity infrastructure — The 'Developer' tier is free, includes 1 member, 0 production environments, 2 development environments, and no included monthly credit.
Managed Keycloak hosting with Phase Two's Organization extension. No free tier since 2026-07-30, when Phase Two shut down its free shared realms. The Starter cluster is $149/month with a 30-day free trial, for up to 15K monthly active users.
Authentication for B2B SaaS — free up to 10,000 MAUs and 10K Transactional Emails (with a watermark branding: "Powered by PropelAuth").The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Now Hexclave — stack-auth.com redirects to hexclave.com, and the GitHub org stack-auth/stack-auth redirects to hexclave/hexclave (same repository). Open-source user infrastructure: auth, teams, RBAC, API keys, emails. Free tier is $0 forever: up to 10,000 auth users, 1 dashboard admin, 1,000 emails per month, email/OAuth/magic links, community support. Also self-hostable for free.The page we cite for this offer does not name it when we last looked, on 2026-09-14, so we cannot confirm these terms today.
A turnkey user and access management that works for you and supports multi-tenant (B2B) use cases. Free for up to 100 Daily Active Users, with all security features (no paywall for OTP, Passwordless, Policies, and so on).The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Self-hosted identity provider covering SSO, SAML, OAuth2/OIDC and LDAP. The open-source edition is free and aimed at homelab users and simple use cases. Enterprise is $5/user/month billed annually with external users at $0.02/user/month and no charge for service accounts; Enterprise Plus starts at $20k annually.
Catch runtime errors, crashes, and exceptions in production. These tools help you detect and fix security-relevant bugs before users report them.
Error monitoring — Includes: 1 user Error and performance monitoring 7.5K events and 1M spans per month 50+ platforms 30+ third-party integrations Free plan features, plus: Unlimited users End-to-end diagnostics Basic notifications
Error tracking with 5,000 occurrences/month, 30-day data retention, 1,000 session replays. Processing stops at limit (no surprise charges)
Open-source error tracking — 1,000 events/month, unlimited projects and team members, Sentry SDK-compatible. Also includes uptime monitoring. Self-hostable for unlimited
Session replay, product analytics and error monitoring, priced by sessions captured; analytics, logs and errors are unlimited on every plan. No free plan: Core, Pro and Enterprise each start with a free trial, no credit card required.
Real-time error, feature, and log reporting. Free plan: 3,000 events/month, 1 project, 1 user, 3-day retention. Also fully open source (Apache 2.0) for self-hosted unlimited use
Error-tracking with Sentry-SDK compatability. Free for up to 5,000 errors/month, or unlimited use when self-hosted.When we last read the page we cite for this offer, on 2026-09-13, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
JavaScript error tracking with screenshots and click trails — There is a free tier with limits of 1,000 logged errors per month, 1,000 log API calls per month, performance metrics for 100 URLs, time on page for 100 URLs, and pageviews for 10,000 URLs. It includes email notifications, screenshots, click trails, and support for one domain and its subdomains.
Error logging and uptime monitoring for web developers. Free Small Business subscription for open-source projects.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Mobile app monitoring. Free for small teams with up to 1 million user sessions per year.
Exception, uptime, and cron monitoring. Developer plan (free): 5,000 errors/month, 1 user, 50 MB/day logging, 1 uptime monitor, 1 status page, 1 dashboard, unlimited projects, 15-day error data retention, 7-day log retention. Intended for low-traffic projects.
Developer friendly bug reports in one click. Free plan with unlimited jams.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Cloud device observability and debugging platform. 100 devices free for [Nordic](https://app.memfault.com/register-nordic), [NXP](https://app.memfault.com/register-nxp), and [Laird](https://app.memfault.com/register-laird) devices.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free all-in-one kill switch for your mobile apps.
One-click bug reports straight in your browser — The Personal plan is $0/month and includes unlimited recordings that are never deleted, time travel (60 second limit), public recordings, and basic privacy filters. It does not include team members or projects.Its pricing page has not resolved for us since 2026-08-06, so we cannot confirm these terms today.
There is no startup program: instabug.com/startups no longer serves one. Checked 2026-09-02, the URL redirects to www.luciq.ai, the company's site after its rebrand to Luciq, whose navigation carries no startups or program page. The former offer was a discount on all Instabug plans for eligible startups.
Free SSL certificates, TLS configuration testing, and web security scanners. Essential baseline security that every site needs.
Superseded: As of 2026-09-15, certkit.io/certificate-management reads: Homelab is a free plan for personal, non-commercial use. We are not publishing our stored CertKit terms beside it — our own pricing change record, discovered 2026-09-15, names them as the previous ones. Read what we recorded ↓
Scan your Django site for security flaws with this free, automated checkup tool. Forked from the Pony Checkup site.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Test for modern Internet Standards like IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANEThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free SSL Certificate Authority with certs trusted by all major browsers
HTTP security header testing tool. Now integrated into MDN as HTTP Observatory.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Intense analysis of the configuration of any SSL web serverThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Free website security check and malware scannerThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Test an SSL/TLS service for secure server configuration, certificates, chains, etc. Not limited to HTTPS.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-28, so we cannot confirm these terms today.
Password managers, fraud detection, threat intelligence, privacy compliance, and other security utilities with free tiers for developers.
Free Teams account for open source projects — includes full platform access (Mac, Windows, iOS, Android, Linux, browser), SSH key management, Git commit signing, and secrets management. Non-expiring membershipThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
URL and website security scanner API — free tier: 50 private scans/day, 1,000 unlisted scans/day, 5,000 public scans/day, 1,000 search requests/day, 10,000 result requests/dayWhen we last read the page we cite for this offer, on 2026-09-21, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
Malware and URL analysis API (Google) — free community tier: 500 requests/day, 4 requests/minute. Scan files, URLs, domains, IPs against 70+ antivirus engines. Non-commercial use onlyWe could not read the page we cite for this offer when we last looked, on 2026-09-13, so we cannot confirm these terms today.
Screen an order transaction for credit card payment fraud. This REST API will detect all possible fraud traits based on the input parameters of an order. The Free Micro plan has 500 transactions per month.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
A login security API to detect fraudulent and suspicious logins and notify your customers. Free for 1,000 logins per month.We could not read the page we cite for this offer when we last looked, on 2026-09-10, so we cannot confirm these terms today.
A simple, intuitive web app for analyzing and decoding/encoding data without dealing with complex tools or programming languages. Like a Swiss army knife of cryptography & encryption. All features are free to use, with no limit. Open source if you wish to self-host.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
REST API for fetching information on data breaches. Free web search; API requires subscription for some endpoints.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-09-02, so we cannot confirm these terms today.
Start free , pay $0.02/month per user beyond 250 users.
Privacy and cookie policies and consent management. The free tier offers limited privacy and cookie policy as well as cookie banners.
Consent management and privacy framework tool — Full-Feature Consent Management at $0/month. No credit card, no limits on jurisdictions or customization.
A free mobile-friendly tool that offers a variety of randomly generated keys and passwords you can use to secure any application, service, or device.
Pareto Cloud is free for up to 5 devices, with no credit card required. The free tier includes the cloud dashboard, alerts to email, Slack and Teams, and the API. Paid Team and Business plans are priced per device per month. The macOS, Linux and Windows apps are open source.
Top free security tools compared by domain, free tier limits, and best use case.
| Tool | Domain | Free Tier | Open Source | Best For |
|---|---|---|---|---|
| Snyk | SAST + SCA | 200 tests/mo, 5 projects | — | All-in-one: code, deps, containers, IaC |
| Semgrep | SAST | ∞ scans (OSS rules) | ✅ | Custom rules, lightweight, fast scans |
| CodeQL | SAST | ∞ (public repos) | ✅ | Deep semantic analysis, GitHub-native |
| SonarCloud | Code Quality + SAST | ∞ (public repos) | — | Code quality + security in one dashboard |
| GitGuardian | Secret Scanning | 25 developers, ∞ scans | — | Real-time secret detection in commits |
| Trivy | Container Security | ∞ (self-hosted) | ✅ | Container images, IaC, SBOM generation |
| Grype | SCA / Deps | ∞ (self-hosted) | ✅ | Fast vulnerability scanner for containers and filesystems |
| Dependabot | Dependency Updates | ∞ (GitHub repos) | ✅ | Auto-PR for vulnerable deps, GitHub-native |
| Auth0 | Identity / Auth | 25K MAU | — | Enterprise auth: SSO, MFA, social login |
| Clerk | Identity / Auth | 10K MAU | — | Modern DX: React components, webhooks |
| Keycloak | Identity / Auth | ∞ (self-hosted) | ✅ | Self-hosted SSO, SAML, OIDC, LDAP |
| HashiCorp Vault | Secrets Management | Community (self-hosted) + HCP Free | ✅ | Dynamic secrets, encryption as a service |
Snyk leads the all-in-one category with code, dependency, container, and IaC scanning in a single tool. For pure SAST, Semgrep and CodeQL are both excellent and free for open-source. GitGuardian is the standard for secret detection. Trivy dominates container scanning. Auth0 has the most generous free auth tier at 25K MAU. Catalogue dates April to September 2026.
Looking for more? Browse all Security, Auth, and Error Tracking tools in our full index of 1,574+ developer deals.
Get security tool recommendations from your AI assistant. Compare SAST scanners, secret managers, auth providers, and container security tools — directly in your editor.
claude mcp add agentdeals -- npx -y agentdealsWorks with Claude Desktop, Cursor, Cline, Windsurf → Full setup guide