Secrets & Credential Scanning
5 entriesKeeping keys, tokens and passwords out of code and repositories.
01git-secretsPrevents you from committing secrets and credentials into git repositories. The GitHub repository's last commit was in September 2025, so check its activity before adopting it.
02GitleaksAn open-source tool that finds secrets such as keys and tokens in git repositories, files and directories, suited to pre-commit hooks and CI checks.
03TruffleHogAn open-source secrets scanner that digs deep into code to find passwords, keys and other sensitive credentials committed by mistake.
04GitGuardianSecrets detection and credential security platform.
05Spectral (Check Point CloudGuard)Developer-first code security that finds exposed API keys, tokens and credentials. Its site says Spectral is now part of Check Point CloudGuard.
Application Security Platforms (SAST, SCA & ASPM)
15 entriesPlatforms that test code and dependencies and prioritise risk.
06SnykFind and automatically fix vulnerabilities in your code, open source dependencies, containers, and infrastructure as code.
07Checkmarx OneA unified application security platform that brings SAST, software composition analysis, API security, and container and infrastructure-as-code scanning into one console.
08VeracodeAn application risk management platform for finding and fixing vulnerabilities in first-party code and open-source dependencies across the software lifecycle.
09Black DuckApplication security testing spanning SAST, SCA and DAST, with open-source license risk management and software supply chain security.
10Mend.ioUnifies application security and AI security, covering code and open-source dependencies as well as risks in AI-powered applications.
11Endor LabsAn application security platform for AI-generated and human-written code that prioritizes and fixes the risks that matter across the development lifecycle.
12SemgrepA developer-friendly application security platform that scans source code with AI-assisted static analysis (SAST), software composition analysis and secrets detection, with rules you can customize.
13SonarQubeStatic analysis for code quality and security across many languages, with quality gates in CI/CD pipelines and verification of AI-generated code.
14GitHub Advanced SecurityBuilt-in security for GitHub repositories — code scanning, secret scanning and dependency review, with AI-powered fixes to protect the software supply chain.
15ApiiroA 360° view of security and compliance risks across applications, infrastructure, developers' knowledge, and business impact.
16CycodeAn agentic development security platform that gives code-to-runtime context to identify, prioritize and fix software risk across the pipeline.
17Aikido SecurityA developer-focused security platform that continuously and autonomously secures what teams build, ship and run.
18ArnicaApplication security platform covering SAST, secrets and supply chain.
19Legit SecurityASPM, AI remediation and secrets scanning.
20DefectDojoAn open-source vulnerability management and application security posture management (ASPM) platform that aggregates findings from many security tools so the most critical issues get fixed first.
Dynamic Testing (DAST)
3 entriesTesting running web applications and APIs in pipelines.
21ZAP by CheckmarxThe world's most widely used free and open source web application security scanner, formerly known as the OWASP Zed Attack Proxy.
22InvictiA DAST-first application security platform that automates accurate testing of web applications and APIs at scale.
23StackHawkDeveloper-focused DAST and API security testing for CI/CD.
Software Supply Chain & SBOM
11 entriesInventorying, signing and verifying what goes into software.
24AnchoreAPI-centric open source tools — Syft and Grype — for container vulnerability scanning and SBOM generation.
25OWASP Dependency-TrackAn open-source platform that inventories components from SBOMs, finds vulnerabilities and enforces policy across the software supply chain.
26SigstoreAn open-source project for signing and verifying software artifacts, so you can confirm that software is what it claims to be.
27ChainguardTrusted open-source artifacts for every layer of the software stack — hardened containers, language libraries and VM images — to cut vulnerabilities at the source.
28OSV-ScannerOpen-source scanner that finds known vulnerabilities in dependencies using the OSV database.
29OpenSSF ScorecardAutomated security checks that score open-source projects.
30in-totoFramework for securing the integrity of software supply chains.
31RenovateAutomated dependency update tool.
32SLSAFramework of levels for supply chain integrity of software artifacts.
33CycloneDXBill of materials standard for software supply chain security.
34SPDXOpen standard for communicating software bill of materials information.
Container, IaC & Cloud Security
15 entriesScanning images, infrastructure code and running workloads.
35TrivyA popular open-source security scanner for container image and dependency vulnerabilities, IaC misconfigurations, SBOM discovery, cloud scanning and Kubernetes security.
36CheckovStatic analysis for infrastructure as code misconfigurations.
37KICSFinds security vulnerabilities and misconfigurations in infrastructure as code.
38tfsec (now part of Trivy)Terraform security scanner; its repository says tfsec is now part of Trivy.
39KubescapeKubernetes security posture and compliance scanning.
40Open Policy AgentGeneral-purpose policy engine for policy as code.
41KyvernoKubernetes-native policy management.
42FalcoOpen-source runtime security for hosts, containers and Kubernetes, with a flexible rules engine that raises immediate alerts on policy violations.
43SysdigRun confidently with secure DevOps — real-time runtime security for containers, Kubernetes, and the cloud.
44WizA cloud and AI security platform that connects code, cloud and runtime. Google completed its acquisition in March 2026; Wiz continues to operate under its own brand across all major clouds.
45TrendAI Vision One Cloud Risk ManagementSuccessor to Trend Cloud One Conformity, which reached end of life in July 2026. Highlights violations of AWS, Azure, Google Cloud, OCI and Alibaba Cloud best practices with over 1,400 checks across security, reliability, cost, performance and operational excellence.
46Prisma CloudCloud security platform from Palo Alto Networks.
47Aqua SecurityCloud native security for containers, serverless and Kubernetes.
48Orca SecurityCloud security platform.
49Microsoft Defender for CloudCloud security posture management and workload protection from Microsoft.
Frameworks & Guidance
4 entriesPractices and standards that DevSecOps programmes follow.
50OWASP DevSecOps GuidelineOWASP guidance on adding security to a DevOps pipeline.
51OWASP SAMMSoftware Assurance Maturity Model for measuring and improving secure development.
52NIST Secure Software Development FrameworkNIST framework of secure software development practices.
53Open Source Security FoundationLinux Foundation project for securing open-source software.
Related Pages
10 entriesRelated directories on this site.
54DevOps for IT AgilityHub of DevOps tools, platforms and guides.
55CI/CD ToolsCI/CD platforms and delivery tools.
56Application Security Testing ToolsSAST, DAST, IAST and SCA platforms.
57Infrastructure as Code Security ToolsSecurity tools for infrastructure as code.
58Container Security ToolsContainer security tools.
59Policy as Code (PaC) SoftwarePolicy enforcement defined as code.
60CybersecurityCybersecurity principles and products.
61Deployment StrategiesCanary, blue-green, rolling and other strategies for releasing services and applications.
62IaC ToolsInfrastructure as code tools for provisioning infrastructure.
63Kubernetes Policy EnginesKyverno, Gatekeeper and other Kubernetes policy tools.
Frequently Asked Questions
What is DevSecOps?
DevSecOps builds security checks into every stage of software delivery, from code and dependencies through build, deployment and runtime, rather than leaving security to the end.
What does "shift left" mean?
It means finding security issues earlier in the pipeline, for example by scanning code, secrets and infrastructure definitions in the IDE and pull request instead of after release.
What is an SBOM and why does it matter?
A software bill of materials lists the components in a piece of software. It lets teams find out quickly whether a newly disclosed vulnerability affects them. CycloneDX and SPDX are the main formats.
Which tools changed ownership or name?
Spectral is now part of Check Point CloudGuard, Wiz is now owned by Google, TrendAI Vision One Cloud Risk Management succeeds Trend Cloud One Conformity, and tfsec is now part of Trivy.
Are the links checked?
Links were checked when this page was updated. Apiiro and Spectral blocked automated checks but loaded in a browser. Socket and Jit are not listed because they did not load.
Which security projects are CNCF graduated?
Kyverno, the Kubernetes policy engine, graduated on 24 March 2026. Open Policy Agent, Falco, in-toto, cert-manager, SPIFFE, SPIRE and The Update Framework are also on the CNCF graduated list in October 2026. In the January 2026 CNCF survey, 36% of respondents named security as a challenge.