# Security Scanning

Fast open-source SAST with custom rules

Semgrep is an AppSec platform with a widely used open-source engine for readable code rules plus commercial SAST, supply-chain and secrets workflows. Current product positioning emphasizes AI-assisted detection, triage and remediation, CI/pull-request integration and managed governance for security teams.

Code quality and security analysis platform

SonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.

Unified code-to-cloud security platform for developers

Aikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.

Developer-first security platform

Snyk is the leading developer security platform providing continuous scanning for vulnerabilities in code (SAST), open-source dependencies (SCA), container images, and infrastructure as code. Integrates directly into IDEs, Git repositories, CI/CD pipelines, and container registries. Features AI-powered fix suggestions, license compliance checking, and real-time vulnerability database. Free for individual developers with paid plans for teams. Supports 30+ programming languages.

Secret scanning across Git history and cloud storage

TruffleHog by Truffle Security scans for high-entropy strings and secrets across GitHub history, S3 buckets, and other data stores with 26.7K+ GitHub stars. It goes beyond simple pattern matching by verifying whether discovered credentials are actually active and valid, significantly reducing false positives and helping teams prioritize remediation of truly exposed secrets.

Secrets security and non-human identity governance across code, CI/CD, endpoints, CLI/IDE/API, and MCP workflows.

GitGuardian is a secrets security and non-human identity governance platform for finding, triaging, and remediating leaked credentials across repositories, CI/CD, developer endpoints, CLI/IDE workflows, APIs, and MCP-connected environments. It combines managed incident workflow with developer-side prevention, Endpoint Protection, and broader credential lifecycle governance.

Open-source secret detection for Git repositories

Gitleaks is an open-source secret scanner with 27K+ GitHub stars that detects hardcoded passwords, API keys, tokens, and private keys in Git repositories, files, directories, and full Git history. It integrates via GitHub Actions, pre-commit hooks, CI/CD pipelines, and single-binary local scans.

All-in-one AI code review, security, and quality

CodeAnt AI combines AI code review, SAST, secret detection, IaC security, policy enforcement, compliance dashboards, and agentic pentesting in one platform for engineering teams that want code quality and security checks before production.

Open-source vulnerability management aggregator

DefectDojo is an open-source vulnerability management platform with 4.7K+ GitHub stars that aggregates findings from 200+ security tools into a single view for ranking, triaging, and tracking remediation. It serves as the operating system for security teams by normalizing data from SAST, DAST, container scanners, and dependency checkers into a unified workflow with deduplication and metrics.

Unified AI code review and application security platform

Panto AI is a unified AI-driven code review and application security platform that combines static analysis, secrets detection, dependency scanning, and infrastructure-as-code security into a single PR workflow. It contextualizes issues based on repository structure and code history to deliver actionable insights directly within pull requests on GitHub, GitLab, and Bitbucket with zero-configuration onboarding and compliance-ready reporting for SOC 2, ISO, and PCI-DSS.

Security scanner for AI model files

ModelScan by Protect AI is an open-source tool that scans machine learning model files for malicious or unsafe code before they are loaded into production. Supporting formats like Pickle, HDF5, and SavedModel, it detects hidden code execution, deserialization attacks, and supply chain threats in the AI/ML model artifact pipeline, integrating into CI/CD as a critical security gate.

AI-native security for coding agents

Corridor is an AI-native security platform that intercepts vulnerabilities at the code generation layer, providing real-time guardrails and automated PR security reviews for teams using AI coding agents like Cursor, Claude Code, and GitHub Copilot. Founded by former CISA Secure by Design lead Jack Cable and backed by $25M Series A from Felicis at a $200M valuation, Corridor embeds proactive security context into developer workflows via MCP server integration.

Prompt fuzzing tool for LLM security testing

ps-fuzz by Prompt Security is a security testing tool with 680+ GitHub stars that fuzzes system prompts against dynamic LLM-based attack scenarios including jailbreaks, prompt injection, and data extraction attempts. It helps developers harden their GenAI applications by simulating adversarial attacks in a controlled environment, turning LLM security into a testable and reproducible quality gate.

AI security triage for small engineering teams

Amplify Security is an AI-native security tool designed for small-to-mid engineering teams that automates the triage of security alerts and integrates directly into GitHub and GitLab workflows. It specifically addresses alert fatigue by using AI to prioritize high-risk findings over low-severity noise, offering a free tier for small teams that makes developer-first security accessible without enterprise budgets.

Pipelineless AppSec for AI-driven development

Arnica is a pipelineless application security platform that scans every code push in real-time across SAST, SCA, IaC, secrets, and license risks without CI/CD pipeline integration. Its Arnie AI engine combines deterministic static analysis with multi-agent reasoning to detect logic flaws and vulnerabilities in both human-written and AI-generated code. It integrates directly with GitHub, GitLab, Bitbucket, and Azure DevOps for 100% repository coverage from day one.

Enterprise application security testing platform

Checkmarx is an enterprise application security testing platform providing SAST, SCA, DAST, API security, IaC scanning, and container security in a unified solution. Features AI-powered vulnerability detection, automated remediation guidance, and correlation across scan types to prioritize the most critical risks. Supports 30+ programming languages with deep framework-specific rules. Integrates with all major IDEs, Git platforms, and CI/CD pipelines. Used by Fortune 500 companies globally.

AI-powered SAST for PR-time security analysis

CodeThreat provides pull request-time security analysis covering SAST, dependency vulnerability checks, and infrastructure-as-code risk review. Highly rated for its seamless GitHub integration, it catches security issues introduced by both human and AI-generated code before they reach production, with particular strength in identifying vulnerabilities from rapid vibe coding workflows.

AI-native AppSec that finds and fixes vulnerabilities

Corgea is an AI-native application security platform that uses LLMs to scan, triage, and automatically fix security vulnerabilities in code. Unlike traditional SAST tools that only detect issues, Corgea focuses on the remediation phase by generating context-aware fixes for vulnerabilities, significantly reducing the time engineering teams spend on security backlog while providing contextual PR reviews and IDE integrations.

Agentic application security from prompt to cloud

Cycode is an AI-native application security platform that converges AST, SSCS, and ASPM into a single solution with the Maestro AI orchestrator managing multi-agent security workflows. It provides native SAST, SCA, secrets detection, IaC scanning, and container security alongside ConnectorX integration with 100+ third-party tools. Cycode's AI Exploitability Agent reduces false positives by 94%, and the Context Intelligence Graph maps risk across code, pipelines, and runtime environments.

AI-native SAST with contextual security analysis

DryRun Security is an AI-native SAST platform using Contextual Security Analysis to reason about code behavior, data flow, and exploitability instead of regex pattern matching. It provides PR-native security reviews on GitHub and GitLab, catching logic flaws, broken auth, IDOR, and injection bugs that legacy scanners miss while cutting 90% of noise. Features Natural Language Code Policies, DeepScan for full-repo audits, and a Risk Register for org-wide visibility. Supports 14+ languages.

Cloud native runtime security for Kubernetes

Falco is a CNCF graduated open-source runtime security tool that detects unexpected behavior and threats across containers, Kubernetes, and cloud workloads in real time. Originally created by Sysdig, Falco monitors Linux kernel syscalls using eBPF and applies customizable detection rules to alert on malicious activity like container escapes, cryptojacking, unauthorized file access, and anomalous network connections. It supports 50+ alert output channels including SIEM integration.

Security operations resilience for SOC teams

Fig provides a Security Operations Resilience platform designed for modern SOC teams facing both unplanned and planned changes. Features drift detection to catch unplanned infrastructure changes, automated drift repair with testing, planned change modeling to simulate initiatives before deployment, version control, and automatic deployment with rollbacks. Helps teams maintain security coverage while shipping risk-free at 10x speed and focusing on strategic cyber work.

Continuous security scanning with AI and human expertise

Fluid Attacks integrates continuous vulnerability scanning into the SDLC by combining AI automation with human security expertise to verify critical flaws. The hybrid approach ensures that automated findings are validated by security researchers before reaching developers, reducing false positive noise while maintaining coverage across SAST, DAST, SCA, and infrastructure-as-code security scanning.

AI security platform for LLM prompt injection protection

Lakera is an AI security platform protecting LLM applications against prompt injection, jailbreaks, data leakage, toxic content, and PII exposure. Lakera Guard provides a real-time API that screens prompts and outputs in under 2ms latency. Trained on the world's largest prompt injection dataset from Gandalf, a public red-teaming game. Deploys as an API proxy or SDK integration with zero model access required. Used by enterprises to secure customer-facing AI applications in production.

Security scanner for MCP servers against tool poisoning attacks

MCP-Scan is a security tool that scans MCP servers for vulnerabilities including tool poisoning, prompt injection, cross-origin escalation, and rug pull attacks. Acquired by Snyk in 2026, it is the first dedicated security scanner for the MCP ecosystem. It analyzes tool descriptions, permissions, and behavior patterns to detect malicious or compromised MCP servers before they can exploit AI agents.

AI-first security scanner for LLM, agent, MCP, and RAG codebases

MEDUSA is an AGPL-3.0 AI-first security scanner from Pantheon Security that checks AI and machine-learning applications, LLM agents, MCP workflows, RAG pipelines, repository-poisoning risks, secrets, and agent-specific compromise patterns.

AI-powered file-type detection at Google scale

Open-source AI-powered file-type detection tool from Google that uses a custom deep-learning model under a few megabytes to identify more than 200 binary and textual content types in milliseconds, even on a single CPU. Magika ships as a CLI, Python package, JavaScript/TypeScript library, and an ONNX model, achieves around 99% accuracy on its test set, and is already used at Google scale across Gmail, Drive, and Safe Browsing as well as by VirusTotal and abuse.ch.

DRM and IP protection for AI model weights

RefortifAI is a Y Combinator P2026 batch company that provides DRM and intellectual property protection for AI models by obfuscating model weights so they only run inside a hardened runtime. It solves the critical problem of model weight protection for companies distributing custom LLMs to untrusted environments, preventing IP theft while maintaining inference performance.

Hunt down social media accounts by username across 400+ platforms

Sherlock is a Python CLI tool that searches for a given username across 400+ social networks and websites simultaneously. It is widely used in OSINT investigations, security audits, red teaming exercises, and digital footprint analysis. Sherlock is included in Kali Linux and Parrot Security distributions and has over 76,000 GitHub stars, making it one of the most popular open-source security tools.

AI framework for distributed vulnerability research

Taskflow Agent is an open-source MIT-licensed AI framework by GitHub Security Lab that automates vulnerability discovery through a three-stage pipeline: threat modeling, issue suggestion, and audit validation. It has discovered 91 confirmed vulnerabilities in major open-source projects including Outline and WooCommerce, using distributed community-powered security research coordinated by AI agents.

Comprehensive open-source vulnerability scanner

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

AI-powered CI reliability and flaky test management

Trunk is a developer tools platform that tackles CI reliability through AI-powered flaky test detection, automatic quarantine, and merge queue management. It uses ML-based statistical analysis to identify flaky tests, isolates them to prevent pipeline blocks, and creates GitHub issues for resolution. Used by Zillow, Brex, and Faire, with $28.5M in funding and support for all major test frameworks.

AI-native SAST with automated PR security reviews

ZeroPath is an AI-native SAST and AppSec platform recognized as an RSAC 2026 finalist that provides automated pull request security reviews with contextual feedback and natural-language fix suggestions. It catches secrets, IaC misconfigurations, and logic flaws in code changes, competing directly with established code review tools but with a security-first AI-native architecture.

AI-automated pentesting with zero false positives

ZeroThreat is an automated penetration testing platform that uses AI to conduct comprehensive security audits, claiming to identify 500+ vulnerability types with zero false positives. It automates the traditionally expensive and manual red-teaming process, providing continuous security assessment for web applications with detailed remediation guidance and compliance-ready reporting.

Sandbox any command with file, network, and credential controls

Zerobox is a security-focused command sandboxing tool that isolates command execution with fine-grained controls over file system access, network connectivity, and credential exposure. It wraps any shell command in a secure container that enforces policy restrictions, preventing unauthorized file reads, network calls, or environment variable leaks during execution.

Google's vulnerability scanner using the OSV database

OSV-Scanner is Google's official open-source vulnerability scanner that checks your project's dependencies against the OSV.dev database — the largest open vulnerability database covering all major ecosystems. Written in Go, it supports lockfiles from npm, pip, Maven, Cargo, Go modules, and more, providing actionable remediation guidance and CI/CD integration for automated security scanning.

Static linter that catches production bugs in AI-generated code

prodlint is a zero-config static analysis tool with 52 rules targeting production bugs that AI coding tools consistently produce. It catches hallucinated npm imports, missing authentication checks, Prisma writes outside transactions, exposed secrets via NEXT_PUBLIC prefixes, and other patterns specific to code generated by Cursor, Claude Code, Bolt, and v0. Runs in one second via npx with no configuration needed.