Every record we hold is listed here, newest first. A record is never removed from this list, so a vendor named here stays named here whatever its verdict does afterwards.
reducedSocket.deveffective between 2026-10-10 and 2026-10-19high
By October 19, 2026, Socket.dev's Free plan covers 1 dev seat, which Socket defines as an active developer who contributes code to your repositories. Its pricing page read "Unlimited developers & repos" for the Free plan on October 10. Source ↗
increasedTwingatediscovered 2026-09-07 · effective date unknownlow
The free tier now includes up to 50 resources, not 10. Source ↗
newKetchdiscovered 2026-08-28 · effective date unknownhigh
The free tier now offers full-feature consent management at $0/month with no credit card required, and no limits on jurisdictions or customization. Unconfirmed. We could not check this change against an archived copy of Ketch's page, so it does not count toward the rating.Source ↗
newPareto Securitydiscovered 2026-08-28 · effective date unknownmedium
A free 'Starter' plan is available for up to 5 devices. It's presented as a general free offering rather than a specific startup program. Unconfirmed. We could not check this change against an archived copy of Pareto Security's page, so it does not count toward the rating.Source ↗
CertKit renamed its free plan Homelab and limited it to personal, non-commercial use between 2026-07-15 and 2026-08-18. Its limits stayed at 2 certificates, 1 agent and 1 seat. Source ↗
reducedSemgrepeffective between 2025-12-23 and 2026-05-08medium
The Free Edition now scans up to 10 private repositories and includes 60 AI credits; the Internet Archive's copy of 2025-12-23 listed unlimited private repositories. It still allows up to 10 contributors. Source ↗
deprecatedProtectumusdiscovered 2026-04-12 · effective date unknownlow
Domain redirects to unrelated 2FA product (Protectimus) We hold no source for this record, so it does not set Protectumus's rating.
rebrandedPyUpdiscovered 2026-04-12 · effective date unknownlow
Rebranded to Safety (getsafety.com) We hold no source for this record, so it does not set PyUp's rating.
CertKit cut its Free plan from 3 host agents to 1 between 2026-02-19 and 2026-03-21. Source ↗
removedHostedScaneffective 2026-03-05low
HostedScan removed its Free plan (Lite Scans, up to 3 targets) between 2026-01-25 and 2026-03-05; Basic, with a free trial, became the entry plan. Source ↗
Private repo free tier expanded from 1 repo to unlimited repos, with 1,000 scans a month and 3 members. socket.dev/pricing showed the Free plan "Limited to 1 private repo" in the Internet Archive's copy of 2025-08-21 and "Unlimited private repositories" in its copy of 2025-11-03. Source ↗
Free plan removed. stackhawk.com/pricing offered a Free plan, "Modern DAST, with unlimited scans, automatable in your CI/CD for a single application", in the Internet Archive's copy of 2024-05-16, and none in its copy of 2024-06-17, which starts at Pro, $42 per code contributor a month with a five-contributor minimum. Source ↗
We hold 11 more records filed under this category that are not counted above: entries the vendor has since reversed, our own index housekeeping, and corrections to earlier entries of our own. Read the full change log.
At-Risk Vendors
All 2 of the 54 vendors we list in this category that carry one. A vendor is named here for as long as a demotion is in force against it: a one-off pricing event, recorded against a source we cite, whose date falls in the last 180 days — or a standing condition, also cited, such as a product retired or a free tier withdrawn and not restored, which does not expire with time. A demotion can lift with nothing about the vendor having changed, and that happens on the day the vendor's newest qualifying event passes 180 days.
All 20 of the 54 vendors we list in this category that qualify, not a selection of them. A vendor is named here for as long as no demotion is in force against it and we hold no change record for it dated in the last 90 days — any record, including ones the timeline above does not count. A vendor can join this section on a day we recorded nothing about it, when the later of those two clocks runs out: 90 days after its newest record, or the day the demotion against it lapses. It leaves on the day we file a new record, or the day we can no longer vouch for the terms we list.