Compare 100+ free security tools — Snyk, Semgrep, CodeQL, GitGuardian, Trivy, Auth0, Clerk, and more. Exact free tier limits by security domain. Catalogue dates April to November 2026.
Security is no longer optional — even side projects get supply chain attacks, credential leaks, and dependency vulnerabilities. The good news: the security tool ecosystem has an unusually strong free tier landscape. Snyk offers free SAST scanning for up to 100 tests/month on up to 5 projects. Semgrep and CodeQL are free for open-source. Trivy and Grype are fully open-source container scanners.
This page compares every free security tool in our index — 104 tools across application security (SAST/DAST), secret scanning, dependency analysis, container security, identity/auth, error tracking, and SSL/compliance. Whether you need code scanning or user authentication, we have the comparison with exact free tier limits.
Looking for alternatives to a specific security tool? See our dedicated guide: Auth0 Alternatives
Static and dynamic analysis tools that find vulnerabilities in your code before they reach production. Ranges from cloud-hosted scanners like Snyk and SonarCloud to open-source engines like Semgrep and CodeQL.
Developer security scanning. Free: up to 5 projects, with 200 Snyk Open Source (SCA) tests, 100 Snyk Code (SAST) tests, 300 IaC tests and 100 Container tests a month (Snyk's usage docs say 400 Open Source tests). Team is $25/month for teams of up to 10 developers, with 100 projects and 1,000 Snyk Code tests a month. Snyk Evo (AI pentesting, coding-agent security) needs an Enterprise subscription.
Code quality and security analysis, free for open-source projects and for private projects up to 50k lines of code: SonarSource lists the "SonarQube Team Plan, free for your private projects up to 50k LOC. No card, no expiry." 40+ languages and frameworks, CI/CD integration. Formerly SonarCloud.
Open source license compliance and software composition analysis (SCA). Free tier: 5 projects, 10 contributing developers, 1 release group, 5 dependency levels for scans, 1 quality check (outdated packages), 5 imported SBOMs, container scanning, SBOM export, API access
Static analysis (SAST) and software composition analysis (SCA) — Free Edition: Cross-file analysis with Pro rules, AI-powered detection, triage, and remediation, 60 AI credits included, Fast CI/CD deploy via Semgrep infrastructure, Scan up to 10 repositories, Maximum 10 contributors, Authentication via GitHub/GitLab
All-in-one appsec platform covering SCA, SAST, CSPM, DAST, Secrets, IaC, Malware, Container scanning, EOL,... Free plan includes two users, scanning of 10 repos, 1 cloud, 2 containers & 1 domain.
Free autonomous security platform that finds, validates and fixes insecure code and packages across +20 languages and frameworks. Free plan for up to 2 team members and 10 repositories, with 10 PR scans a month and 10 SAST auto fixes. Features: AI SAST, Logic/Auth Scanning, Dependency Scanning, Secrets Detection, Container Scanning, IaC Scanning.
Open Source CLI tool to prevent Kubernetes misconfigurations by ensuring that manifests and Helm charts follow best practices as well as your organization’s policiesWe could not read the page we cite for this offer when we last looked, on 2026-11-10, so we cannot confirm these terms today.
Monitor Java, Javascript, .NET, Scala, Ruby, and NodeJS projects for security vulnerabilities in dependencies. Free for one private project, unlimited projects for open source.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Find web app vulnerabilities, audit for OWASP RisksThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
There is no free tier: SOOS has shut down. Checked 2026-11-02, soos.io, app.soos.io and kb.soos.io return HTTP 410 with "SOOS.io has shut down. This site / service no longer exists." The Internet Archive has the live site on 2026-06-15 and the notice from 2026-08-27. The former offer was free, unlimited SCA scans for open-source projects.
Helps implement privacy by design via audits and continuous workflows so that organizations comply with GDPR and other regulations. The free tier is limited to smaller teams and the SaaS version only.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Open source (Apache 2.0) IaC static analysis. Scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and 10+ frameworks for misconfigurations. No usage limits.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Open source (Apache 2.0) web application security scanner. Passive/active scanning, AJAX spider, fuzzing, manual interception, CI/CD integration. No usage limits.The page we cite for this offer does not name it when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Open source (MIT) vulnerability scanner with YAML-based template system. 9,000+ community templates for web apps, APIs, networks, DNS, SSL. No usage limits.When we last read the page we cite for this offer, on 2026-10-24, we found the same terms as an earlier read we had declined to record, so we cannot confirm these terms today.
GitHub semantic code analysis engine. Free for all public repositories with no scan limits. Supports JS/TS, Python, Java, C#, C/C++, Go, Ruby. Integrated into GitHub Actions.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Free plan with 5 scan hours/month for web application and API vulnerability scanning, up to 3 users, full API access. No credit card required.
Hosted DAST for CI/CD, repositioned as a security platform for AI coding agents. No free tier. stackhawk.com/pricing, read 2026-09-20, publishes two plans: Wingman at $10 per user per month, covering unlimited apps and 50 agentic scans per user per month, and StackHawk Scale on request. The page states "unlimited apps — no per-app or per-scan math", so there is no per-app rate, and every occurrence of "free" on it names a 14-day trial.
Prevent credential leaks and manage secrets securely. GitGuardian catches secrets in commits, while Vault, Doppler, and Infisical provide runtime secret management with rotation and access controls.
Secrets management — free for 3 users, $8 a month per additional user (Doppler: "AI agents and non-human identities ride free"). 10 projects, 4 environments per project, 3 days of activity logs. CLI, SDKs, and integrations included
Free tier includes 5 identities, unlimited projects, 100+ integrations, Secret Sharing, Secret References and Imports, Secret Overrides, 2FA.
Self-hosted free (BSL 1.1 license). HCP Vault Secrets cloud free tier: 25 apps, 25 static secrets, 5 versions, 5 syncsWe could not read the page we cite for this offer when we last looked, on 2026-11-08, so we cannot confirm these terms today.
Secrets detection for up to 25 developers — 550+ secret types, unlimited real-time scanning, 500 historical scan detections, CLI (ggshield) for pre-commit hooks, VSCode extension, 10K API calls/month
Cloud-first, developer-friendly security platform prevents data breaches in .NET and Java applicationsWhen we last read the page we cite for this offer, on 2026-11-04, we found no earlier figure of ours for the page to have narrowed, so we cannot confirm these terms today.
Sync your .env files, quickly & securely. Stop sharing your .env files over insecure channels like Slack and email, and never lose an important .env file again. Free for up to 3 teammates.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Secure Enterprise-grade platform for managing environment variables and secrets — Free plan includes 1 organization, 3 apps per organization, 2 environments per app, 50 variables per environment, 2 secure files per environment, and 2 API keys.
Open source (MIT) secret scanner for git repositories, files, and directories. CLI tool is free with no limits. The GitHub Action needs no license key on personal accounts; repositories owned by a GitHub organization need a free license key from gitleaks.io.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Open source (AGPL-3.0) secret scanner for git repos, Docker images, S3, Slack, and 20+ sources. Detects 800+ credential types with active API verification.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Always Free: 6 active secret versions, 10K access operations/month, 3 rotation notifications/month. Centralized secrets storage with IAM-based access control
Automated dependency scanning, vulnerability alerts, and update management. These tools catch known CVEs in your dependency tree and can auto-create PRs to fix them.
Socket.dev is a supply chain security tool for open source dependencies. The Free plan includes 1 dev seat, unlimited dashboard users and repositories, 1,000 scans a month, and 500 API requests an hour. Team starts at $25 per dev seat a month from 5 seats. Open-source projects can ask for a free Team account.
Open source (Apache 2.0) vulnerability scanner for container images and filesystems. Covers 20+ language ecosystems with daily-updated CVE database.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Free automated dependency updates and vulnerability alerts for all GitHub repos. Generates pull requests for updates across 30+ ecosystems (npm, pip, Maven, Go, Docker, etc.).The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
Open source (AGPL-3.0) automated dependency update bot. Supports 90+ package managers. Available as self-hosted CLI or free hosted GitHub/GitLab App by Mend.The page we cite for Renovate names a plan but states no amount, so these limits come from our own record rather than from that page.
Scan container images for vulnerabilities, enforce Kubernetes policies, and secure network access. Most are open-source with no usage limits when self-hosted.
Zero trust network access — Starter plan is free and includes up to 5 users and up to 50 Resources.
Mesh VPN with WireGuard — 6 users, unlimited devices, MagicDNS, exit nodes, subnet routing. Free Personal plan.
High confidence Indicator of Compromise(IOC) targeting public cloud infrastructure, A portion is available on github (https://github.com/unknownhad/AWSAttacks). Full list is available via APIThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Open source (Apache 2.0) multi-target vulnerability scanner for container images, filesystems, git repos, IaC, Kubernetes, SBOMs, and cloud resources.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-14, so we cannot confirm these terms today.
CNCF Graduated (Apache 2.0) runtime security tool. Monitors Linux syscalls and Kubernetes events to detect threats in containers, hosts, and cloud environments in real time.
User authentication, authorization, and identity management — from managed services like Auth0 and Clerk to self-hosted options like Keycloak and SuperTokens. Free tiers typically measured by monthly active users.
Drop-in auth with 50K monthly retained users free, unlimited apps
Identity platform — 25K MAU (B2C), unlimited logins, social + database connections, Universal Login, 1 Enterprise Connection, 5 Organizations, 1 Custom Domain. No credit card required
10,500 MAU, OAuth 2.0/OIDC/SAML, MFA (email/SMS/app), passwordless, multi-tenancy (5 organizations), feature flags (10 max). No credit card required
User Management is free for up to 1 million users. Single Sign-On starts at $125/connection. Directory Sync starts at $125/connection. Audit Logs are free with paid options for log streaming and event retention. Radar is free for the first 1,000 checks.
Authorization-as-a-service — Community plan, free forever: 1,000 MAU, 20 tenants, no limit on authorization queries, 25 roles, 50 resource types, 5 condition sets, 2,000 role assignments, 20 groups, 2,000 resource instances and 2,000 relationship tuples, with 3 environments and no limit on projects. All features are open to all tiers. Open-source projects can get the Startup tier free.The page we cite for Permit.io states in words that it is free, which confirms the price — the limits stated here come from our own record rather than from that page.
Authentication and fraud prevention — 10,000 MAU, passwordless login, OAuth, MFA, session management, device fingerprinting, 5 SSO/SCIM connections, 1,000 M2M tokens, password breach detection
Authentication and user management. Free Forever plan: 7,500 MAU, 10 tenants, 3 SSO connections. All core auth methods: passwords, magic links, OTP, passkeys, social login, MFA
Passkey-first authentication — The 'Starter' (Free) tier includes 10,000 MAUs and 2 Projects. A 'Startup Plan' offers 1 million MAUs. All tiers include 10,000 free monthly active users.
Free OSS (Apache 2.0). Red Hat-backed identity and access management. SSO, OIDC, SAML, LDAP, social login, MFA, fine-grained authorization. Self-hosted with no user limitsThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-09, so we cannot confirm these terms today.
Identity platform — "FusionAuth Community is free and unlimited": self-host it on your own infrastructure, with the core authentication features and community support (forums, Slack, GitHub).
Open source authentication — Self hosting the open source features is free without any limits! Cloud is free under 5K MAUs. Multi-factor Authentication is $0.01 / MAU (Minimum $100 / month). Account Linking is $0.005 / MAU (Minimum $100 / month).
A free tool to search a username across 150+ social platforms to find matching profiles.
Fine-grained authorization as a service for applications and APIs. Free up to 1000 MAUs and 100 authorizer instances.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Seamless Integration of SSO, MFA, passwordless auth and more. Includes SDKs for frontend and backend apps. Free tier: 7,500 Consumer MAUs (B2C), 250 B2B MAUs, 2 social login providers.When we last read the page we cite for this offer, on 2026-10-31, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
Bring Passwordless, OTPs, 2FA, SSO to your apps in minutes. All Front-end included. Free tier: unlimited MAUs, up to 2 applications, 2 admin seats, 100 SMS/WhatsApp messages.
First 1000 billable calls are free. 0.0012 USD per call, billed monthly.
Two-factor authentication (2FA) on multiple devices, with backups. Drop-in replacement for Google Authenticator. Free for up to 100 successful authentications.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
A complete authorization management system for authoring, testing, and deploying access policies. Fine-grained authorization and access control, free up to 100 monthly active principals.When we last read the page we cite for this offer, on 2026-10-24, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
Keycloak Identity and Access Management as a Service. Free up to 100 users and one realm.
Two-factor authentication (2FA) for website or app. Free for ten users, all authentication methods, unlimited, integrations, hardware tokens.
Two-factor authentication (2FA) by push notifications, free for 3 users, VPN, Websites, and SSH
Open-source identity solution — Free tier is $0/month for up to 50,000 MAU and 50K tokens. Includes user authentication, machine-to-machine apps, account APIs, audit logs, and user management. Additional features like RBAC, MFA, and Organizations are paid add-ons.
MojoAuth makes it easy to implement Passwordless authentication on your web, mobile, or any application in minutes. — Free up to 25,000 MAUs. No credit card required.
Developer authentication via Auth0 platform — 25,000 MAU free, social login, passwordless, MFA, SSO. Note: developer.okta.com/signup now routes to Auth0.When we read the page we cite for this offer on 2026-10-06, we found the same terms as an earlier read we had declined to record, and we have read it again since, on 2026-10-31, without confirming the terms above, so we cannot confirm these terms today.
Open-source identity infrastructure — The 'Developer' tier is free, includes 1 member, 0 production environments, 2 development environments, and no included monthly credit.
Managed Keycloak hosting with Phase Two's Organization extension. No free tier since 2026-07-30, when Phase Two shut down its free shared realms. The Starter cluster is $149/month after a 30-day free trial; users are unlimited, and it is sized for 5,000 active users a month.
Authentication for B2B SaaS — free up to 10,000 MAUs and 10K Transactional Emails (with a watermark branding: "Powered by PropelAuth").
Open-source user infrastructure, formerly Stack Auth: auth, teams, RBAC, API keys, emails. Free tier is $0 forever: up to 10,000 auth users, 1 dashboard admin, 1,000 emails per month, email/OAuth/magic links, community support. Also self-hostable for free.
User sign-up and sign-in for web and mobile apps. Free tier: 10,000 monthly active users per account on the Lite and Essentials tiers, with no 12-month limit; user pools created on or before November 22, 2024 keep 50,000. Users who sign in through SAML or OIDC federation: 50 MAU free. The Plus tier and machine-to-machine token requests are paid only.
A turnkey user and access management that works for you and supports multi-tenant (B2B) use cases. Free for up to 100 Daily Active Users, with all security features (no paywall for OTP, Passwordless, Policies, and so on).
Self-hosted identity provider covering SSO, SAML, OAuth2/OIDC and LDAP. The open-source edition is free and aimed at homelab users and simple use cases. Enterprise is $5/user/month billed annually with external users at $0.02/user/month and no charge for service accounts; Enterprise Plus starts at $20k annually.
Catch runtime errors, crashes, and exceptions in production. These tools help you detect and fix security-relevant bugs before users report them.
Error monitoring — Includes: 1 user Error and performance monitoring 7.5K events and 1M spans per month 50+ platforms 30+ third-party integrations Free plan features, plus: Unlimited users End-to-end diagnostics Basic notifications
Error tracking with 5,000 occurrences/month, 30-day data retention, 1,000 session replays. Processing stops at limit (no surprise charges)
Open-source error tracking — 1,000 events/month, unlimited projects and team members, Sentry SDK-compatible. Also includes uptime monitoring. Self-hostable for unlimited
1,000 sessions a month for $0 on the Free plan, free forever. LogRocket Galileo is not included. Analytics events, error events and logs are unlimited on every plan. LogRocket provides session replay, product analytics and error monitoring. Core starts at $83 a month for 10,000 sessions. Pro starts at $292 a month for 10,000 sessions. Both prices are billed annually. A 14-day free trial of the paid plans is available.
Real-time error, feature, and log reporting. Free plan: 3,000 events/month, 1 project, 1 user, 3-day retention. Also fully open source (Apache 2.0) for self-hosted unlimited use
Error-tracking with Sentry-SDK compatability. Free for up to 5,000 errors/month, or unlimited use when self-hosted.When we last read the page we cite for this offer, on 2026-11-13, we found a change we could not reconcile with the terms we publish, so we cannot confirm these terms today.
JavaScript error tracking with screenshots and click trails — There is a free tier with limits of 1,000 logged errors per month, 1,000 log API calls per month, performance metrics for 100 URLs, time on page for 100 URLs, and pageviews for 10,000 URLs. It includes email notifications, screenshots, click trails, and support for one domain and its subdomains.
Error logging and uptime monitoring for web developers. Free Small Business subscription for open-source projects.
Mobile app monitoring. Free for small teams with up to 1 million user sessions per year.
Exception, uptime, and cron monitoring. Developer plan (free): 5,000 errors/month, 1 user, 50 MB/day logging, 1 uptime monitor, 1 status page, 1 dashboard, unlimited projects, 15-day error data retention, 7-day log retention. Intended for low-traffic projects.
Bug reports with console logs, network requests and device details captured in one click, from a browser extension or the Jam for Mac app. The Free plan is $0 with 30 Jams a month, 5 Recording Links and recordings up to 5 minutes; it includes Jira and Linear integrations, webhooks and debugging Jams through Jam's MCP server. Team is $14 per creator a month, billed yearly, with unlimited Jams and 150 Recording Links.
Cloud device observability and debugging platform. 100 devices free for [Nordic](https://app.memfault.com/register-nordic), [NXP](https://app.memfault.com/register-nxp), and [Laird](https://app.memfault.com/register-laird) devices.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Free all-in-one kill switch for your mobile apps.
One-click bug reports straight in your browser — The Personal plan is $0/month and includes unlimited recordings that are never deleted, time travel (60 second limit), public recordings, and basic privacy filters. It does not include team members or projects.Its pricing page has not resolved for us since 2026-09-28, so we cannot confirm these terms today.
There is no startup program: instabug.com/startups no longer serves one. Checked 2026-09-02, the URL redirects to www.luciq.ai, the company's site after its rebrand to Luciq, whose navigation carries no startups or program page. The former offer was a discount on all Instabug plans for eligible startups.
Free SSL certificates, TLS configuration testing, and web security scanners. Essential baseline security that every site needs.
CertKit automates SSL/TLS certificate issuance and renewal, deploys certificates through an agent, monitors domains' SSL certificates, and searches Certificate Transparency logs. The Homelab plan is free for personal, non-commercial use only, with 2 certificates, 1 agent, 1 seat and 3 domain SSL monitors. Businesses evaluating CertKit get a free 30-day trial instead, with no credit card. Homelab allows one account per person or organization.
Scan your Django site for security flaws with this free, automated checkup tool. Forked from the Pony Checkup site.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Test for modern Internet Standards like IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANEThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Free SSL Certificate Authority with certs trusted by all major browsers
HTTP security header testing tool. Now integrated into MDN as HTTP Observatory.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Intense analysis of the configuration of any SSL web serverThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Free website security check and malware scannerThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
Test an SSL/TLS service for secure server configuration, certificates, chains, etc. Not limited to HTTPS.We could not read the page we cite for this offer when we last looked, on 2026-11-08, so we cannot confirm these terms today.
Password managers, fraud detection, threat intelligence, privacy compliance, and other security utilities with free tiers for developers.
Free Teams account for open source projects — includes full platform access (Mac, Windows, iOS, Android, Linux, browser), SSH key management, Git commit signing, and secrets management. Non-expiring membershipThe page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-09, so we cannot confirm these terms today.
URL and website security scanner API — free tier: 50 private scans/day, 1,000 unlisted scans/day, 5,000 public scans/day, 1,000 search requests/day, 10,000 result requests/day
Malware and URL analysis API (Google) — free community tier: 500 requests/day, 4 requests/minute. Scan files, URLs, domains, IPs against 70+ antivirus engines. Non-commercial use onlyWe could not read the page we cite for this offer when we last looked, on 2026-11-09, so we cannot confirm these terms today.
Screen an order transaction for credit card payment fraud. This REST API will detect all possible fraud traits based on the input parameters of an order. The Free Micro plan has 500 transactions per month.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-10, so we cannot confirm these terms today.
A login security API to detect fraudulent and suspicious logins and notify your customers. Free for 1,000 logins per month.
A simple, intuitive web app for analyzing and decoding/encoding data without dealing with complex tools or programming languages. Like a Swiss army knife of cryptography & encryption. All features are free to use, with no limit. Open source if you wish to self-host.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-10-11, so we cannot confirm these terms today.
REST API for fetching information on data breaches. Free web search; API requires subscription for some endpoints.The page we cite for this offer states no amount, tier or rate we can read when we last looked, on 2026-11-02, so we cannot confirm these terms today.
Start free , pay $0.02/month per user beyond 250 users.
Privacy and cookie policies and consent management. The free tier offers limited privacy and cookie policy as well as cookie banners.
Consent management and privacy framework tool — Full-Feature Consent Management at $0/month. No credit card, no limits on jurisdictions or customization.
A free mobile-friendly tool that offers a variety of randomly generated keys and passwords you can use to secure any application, service, or device.
Pareto Cloud is free for up to 5 devices, with no credit card required. The free tier includes the cloud dashboard, alerts to email, Slack and Teams, and the API. Paid Team and Business plans are priced per device per month. The macOS, Linux and Windows apps are open source.
Top free security tools compared by domain, free tier limits, and best use case.
| Tool | Domain | Free Tier | Open Source | Best For |
|---|---|---|---|---|
| Snyk | SAST + SCA | 200 tests/mo, 5 projects | — | All-in-one: code, deps, containers, IaC |
| Semgrep | SAST | ∞ scans (OSS rules) | ✅ | Custom rules, lightweight, fast scans |
| CodeQL | SAST | ∞ (public repos) | ✅ | Deep semantic analysis, GitHub-native |
| SonarCloud | Code Quality + SAST | ∞ (public repos) | — | Code quality + security in one dashboard |
| GitGuardian | Secret Scanning | 25 developers, ∞ scans | — | Real-time secret detection in commits |
| Trivy | Container Security | ∞ (self-hosted) | ✅ | Container images, IaC, SBOM generation |
| Grype | SCA / Deps | ∞ (self-hosted) | ✅ | Fast vulnerability scanner for containers and filesystems |
| Dependabot | Dependency Updates | ∞ (GitHub repos) | ✅ | Auto-PR for vulnerable deps, GitHub-native |
| Auth0 | Identity / Auth | 25K MAU | — | Enterprise auth: SSO, MFA, social login |
| Clerk | Identity / Auth | 50K MRU per app | — | Modern DX: React components, webhooks |
| Keycloak | Identity / Auth | ∞ (self-hosted) | ✅ | Self-hosted SSO, SAML, OIDC, LDAP |
| HashiCorp Vault | Secrets Management | Community (self-hosted) + HCP Free | ✅ | Dynamic secrets, encryption as a service |
Snyk leads the all-in-one category with code, dependency, container, and IaC scanning in a single tool. For pure SAST, Semgrep and CodeQL are both excellent and free for open-source. GitGuardian is the standard for secret detection. Trivy dominates container scanning. Auth0 has the most generous free auth tier at 25K MAU. Catalogue dates April to November 2026.
Looking for more? Browse all Security, Auth, and Error Tracking tools in our full index of 1,498+ developer deals.