OSI-licensed open source
Software security tools find vulnerabilities before attackers do: static analysis of source code, scanning of dependencies and containers, detection of leaked secrets, infrastructure-as-code checks and dynamic web testing. Open-source scanners are the backbone of most DevSecOps pipelines because they run in CI with no per-seat cost.
This guide picks one strong open-source tool per job so you can assemble a pipeline. Licenses were read from each repository; note that Semgrep's engine is LGPL-2.1 and SonarQube Community uses LGPL-3.0.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| Semgrep | Custom SAST rules | Free, open source engine (self-hosted); paid platform - see vendor pricing | LGPL-2.1 |
| Trivy | Container and image scanning | Free, open source (self-hosted) | Apache-2.0 |
| OWASP ZAP | Dynamic web app testing | Free, open source (self-hosted) | Apache-2.0 |
| Gitleaks | Secrets detection | Free, open source (self-hosted) | MIT |
| OSV-Scanner | Dependency vulnerability checks | Free, open source (self-hosted) | Apache-2.0 |
| Dependency-Track | SBOM-based portfolio tracking | Free, open source (self-hosted) | Apache-2.0 |
| Checkov | IaC policy checks | Free, open source (self-hosted) | Apache-2.0 |
| Nuclei | Fast template-driven scanning | Free, open source (self-hosted) | MIT |
| SonarQube Community Build | Code quality and security gates | Free, open source Community Build (self-hosted); paid editions - see vendor pricing | LGPL-3.0 |
Best for: Custom SAST rules · Free, open source engine (self-hosted); paid platform - see vendor pricing
Semgrep is a fast static analysis engine with rules that resemble the code they match. The open-source engine is LGPL-2.1.
Best for: Container and image scanning · Free, open source (self-hosted)
Trivy scans containers, filesystems, repositories and IaC for vulnerabilities, misconfigurations and secrets.
Best for: Dynamic web app testing · Free, open source (self-hosted)
ZAP is a widely used open-source web application security scanner and proxy for dynamic testing.
Best for: Secrets detection · Free, open source (self-hosted)
Gitleaks detects hardcoded secrets in git repositories and files.
Best for: Dependency vulnerability checks · Free, open source (self-hosted)
OSV-Scanner checks project dependencies against the OSV vulnerability database.
Best for: SBOM-based portfolio tracking · Free, open source (self-hosted)
Dependency-Track is a component analysis platform that tracks software bills of materials and vulnerabilities across projects.
Best for: IaC policy checks · Free, open source (self-hosted)
Checkov scans infrastructure-as-code such as Terraform and Kubernetes manifests for misconfigurations.
Best for: Fast template-driven scanning · Free, open source (self-hosted)
Nuclei is a template-based vulnerability scanner with a large community template library.
Best for: Code quality and security gates · Free, open source Community Build (self-hosted); paid editions - see vendor pricing
SonarQube analyzes code for bugs, vulnerabilities and quality issues; the repository is LGPL-3.0.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Static analysis with custom rules | Semgrep, SonarQube Community Build |
| Container image scanning | Trivy |
| Dependency and SBOM tracking | OSV-Scanner, Dependency-Track |
| Leaked secrets | Gitleaks |
| Terraform and Kubernetes checks | Checkov, Trivy |
| Testing a running web app | OWASP ZAP, Nuclei |
Quick answers to common questions
SAST, SCA or dependency scanning, container scanning, secrets detection, IaC scanning and DAST.
They cover core scanning well, but commercial platforms add triage, reporting and support.
Run fast scanners on every pull request in CI and heavier scans on a schedule.
Only scan systems you own or have written permission to test.
List it on TechLogHub and we'll review it for this guide.
