The open-source toolbox

Open-source security, by task.

Scan your code, check dependencies, find exposed secrets or add safeguards to AI agents. Find a focused project, its setup needs and its limits.

Find a tool Start with OWASP guidance

Most tools need a developer or IT owner to set them up and review findings. Each listing links to the official project and quickstart. OWASP references below help you decide what to check.

Want these tools to work as one security workflow?

Choose a tool for a specific gap, name someone to operate it and decide how findings become verified fixes. Start with your existing issue tracker and evidence store; compare coordination software or managed support only if that work becomes a bottleneck.

Build a workflow around the tools you already use

Choose the job

Find your starting point

Sources reviewed: 2026-10-29

Search projects or tasks

Shielda projects only

Project category

Projects shown: 12 / 12

Weekly team time: planning for 1–25 people

Planning scenario: 1–25 people, up to 25 endpoints, 1–3 repositories and one small cloud environment where relevant. After initial setup, with no active incident or major backlog. Time is the whole customer team's combined weekly involvement, not time per person or scanner runtime.

Ranges cover routine review, administration and assigning follow-up work. Add onboarding, implementing fixes, incidents, major upgrades, restore exercises and audit/legal work separately. Tools cover different jobs: do not add overlapping estimates or compare them as a speed ranking.

These are editorial time budgets, not vendor claims, observed averages or service commitments. We add the displayed allowances for two recurring tasks. Linked product documentation explains the tasks, not the number of hours. Replace the allowance with a time log from your own pilot; larger or more complex environments are outside this scenario.

Scan source code

Semgrep Community Edition

Find suspicious patterns and common mistakes in source code using configurable rules.

Use it for: A developer who wants a focused code check locally or in a pull request.

Weekly customer-team involvement

~1–3 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review new findings with repository owners: 30–90 min/week
Maintain rules and check scan coverage: 30–90 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Choose rules for your language, scan one repository, then review findings with the code owner.
Who runs it: Developer setup; rule selection and finding review.
What to know: CE analysis is limited to a function or file. The LGPL engine is open source; Semgrep-maintained rules have a separate license restricted to internal use. Platform features have separate terms.

Semgrep & contributors LGPL-2.1 (engine); separate rule licenses

Get started GitHub Plan with this tool

Check dependencies

OSV-Scanner

Match the packages your project uses to known vulnerability advisories in OSV.

Use it for: A first dependency check for a repository, lockfile or container image.

Weekly customer-team involvement

~0.5–2 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review new advisories and affected versions: 15–60 min/week
Check scan inputs and assign upgrades: 15–60 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Scan your source directory or supported package files. Review affected versions and test any proposed upgrade.
Who runs it: Developer command line or CI setup.
What to know: Coverage depends on supported ecosystems and advisory data. A clean result does not cover custom code bugs or every deployed component.

Google & contributors Apache-2.0

Get started GitHub Plan with this tool

Check dependencies

OWASP Dependency-Check

Report known vulnerabilities associated with application dependencies.

Use it for: Teams wanting dependency reports in an existing build, including Maven or Gradle.

Weekly customer-team involvement

~0.5–2 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review new advisories and affected versions: 15–60 min/week
Check scan inputs and assign upgrades: 15–60 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Add the build integration or run the CLI. Keep advisory data current and review package matches.
Who runs it: Developer setup, data caching and suppression review.
What to know: Package identification can produce false matches. Data-source credentials and rate limits affect scans; an NVD API key is strongly recommended upstream.

OWASP project contributors Apache-2.0

Get started GitHub Plan with this tool

Check dependencies

OWASP Dependency-Track

Track component risk across applications using software bills of materials (SBOMs).

Use it for: A team that needs ongoing visibility across several projects, beyond a one-off scan.

Weekly customer-team involvement

~1–3 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review component findings across projects: 30–90 min/week
Check SBOM uploads and service health: 30–90 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Generate SBOMs in your builds, submit them to the service and assign owners to review changes.
Who runs it: Someone must host the service and maintain SBOM uploads.
What to know: It depends on complete, current inventories and advisory feeds. It does not replace source-code review or deployment checks.

OWASP project contributors Apache-2.0

Get started GitHub Plan with this tool

Find exposed secrets

Gitleaks

Maintenance: security patches only

Find likely passwords, API keys and tokens in Git history or files.

Use it for: Checking a repository before sharing it or preventing new secret commits.

Weekly customer-team involvement

~0.5–1 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review suspected secrets with their owners: 15–30 min/week
Check repository coverage and exceptions: 15–30 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Scan the repository and add a pre-commit or CI check. Revoke or rotate confirmed exposed credentials.
Who runs it: Developer setup and a credential owner for fixes.
What to know: Detection does not revoke credentials. The maintainer now limits Gitleaks releases to security patches; check the README before adopting it. The separate GitHub Action has its own terms.

Gitleaks contributors MIT (CLI)

Get started GitHub Plan with this tool

Test a web app

ZAP

Inspect a running web application and test for common web vulnerabilities.

Use it for: Testing how your application behaves over HTTP, alongside code and dependency checks.

Weekly customer-team involvement

~1–3 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review web findings and reproduce priorities: 30–90 min/week
Check test scope, authentication and scan configuration: 30–90 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Start with your own test environment. Configure login and scope so the scanner reaches the features you need to check.
Who runs it: Developer or tester setup; authenticated scans need more configuration.
What to know: Active scans send test attacks and can change application state. Scan only authorized targets; business logic and access rules still need manual tests.

ZAP by Checkmarx & contributors Apache-2.0

Get started GitHub Plan with this tool

Check infrastructure

Trivy

Scan container images, files and infrastructure definitions for known vulnerabilities, secrets and misconfigurations.

Use it for: A practical first check for a container image or deployment repository.

Weekly customer-team involvement

~0.5–2 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review new advisories and affected versions: 15–60 min/week
Check scan inputs and assign upgrades: 15–60 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Choose the target and scanner types, run a scan and assign the findings to the people who can change the image or configuration.
Who runs it: Developer or infrastructure owner; update data and tune policies.
What to know: Findings depend on supported packages and the selected scanners. It does not automatically harden a live service or prove exploitability.

Aqua Security & contributors Apache-2.0

Get started GitHub Plan with this tool

Check infrastructure

Checkov

Check infrastructure-as-code files for risky configuration before deployment.

Use it for: Teams using Terraform, CloudFormation, Kubernetes, Helm or similar deployment files.

Weekly customer-team involvement

~0.5–2 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review configuration findings with infrastructure owners: 15–60 min/week
Maintain scan coverage and policy exceptions: 15–60 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Scan an infrastructure directory locally or in CI. Review failed policies with the person responsible for the environment.
Who runs it: Infrastructure knowledge; policy tuning and justified exceptions.
What to know: A configuration scan cannot prove the live environment matches the files. Hosted platform services and some data integrations have separate requirements.

Prisma Cloud / Bridgecrew & contributors Apache-2.0

Get started GitHub Plan with this tool

Review project practices

OpenSSF Scorecard

Review repository practices such as code review, dependency updates and build protections.

Use it for: Choosing an open-source dependency or improving the way your own project is maintained.

Weekly customer-team involvement

~0.5–1 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review changed project-practice checks: 15–30 min/week
Assign repository-setting follow-up: 15–30 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Inspect the individual checks for a repository and decide which gaps matter to your use case.
Who runs it: A maintainer or developer who can interpret repository settings.
What to know: The checks are heuristics with false positives and negatives. A high score is not proof that code is safe or free of vulnerabilities.

OpenSSF & contributors Apache-2.0

Get started GitHub Plan with this tool

Monitor systems & advisories

Wazuh

Collect security events and monitor endpoints for configuration issues, file changes and known vulnerabilities.

Use it for: A team with someone available to operate monitoring and investigate alerts.

Weekly customer-team involvement

~3–6 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Triage security events and assign response: 120–240 min/week
Maintain agents, rules and service health: 60–120 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Deploy the central components and endpoint agents, tune the rules and define who responds to each alert.
Who runs it: Ongoing system administration and security operations.
What to know: Hosting, updates, alert review and response remain your work. Licenses differ by component: the current repository includes GPL-2.0 and AGPL-3.0 engine code.

Wazuh & contributors GPL-2.0 / AGPL-3.0 by component

Get started GitHub Plan with this tool

Control AI agents

By Shielda

Agent Guard

Experimental alpha

TypeScript libraries that limit which tools an AI agent can run, on which resources, and with which approvals.

Use it for: Developers adding controlled tool execution or MCP integrations to an agent application.

Weekly customer-team involvement

Not yet measured

Confirm responsibilities and time in a pilot

Experimental library with application-specific access and approval rules. Measure grant review, policy changes and incident handling in your integration; no recurring weekly benchmark is established.

Scenario & exclusions

Setup, effort & limits

How to use it: Register tools, grant task access and route calls through the guard. Add your own authenticated approval flow for sensitive actions.
Who runs it: TypeScript integration and a review of the threat model.
What to know: Experimental alpha. It controls registered calls within one process; it is not an OS sandbox or a universal prompt-injection detector. Durable or distributed enforcement needs additional infrastructure.

ShieldaAI Apache-2.0

Get started GitHub Plan with this tool

Monitor systems & advisories

By Shielda

Security Watch

Experimental alpha

Match security advisories and news to a declared inventory, keep the evidence and send findings to Slack or email.

Use it for: A small installation that needs a focused advisory feed for its libraries and systems.

Weekly customer-team involvement

~0.5–2 h/week

Editorial planning allowance · 1–25 people · team total after setup

What is included in this allowance?

Review matched advisories and assign action: 15–60 min/week
Update inventory and check delivery health: 15–60 min/week

Scenario & exclusions

Setup, effort & limits

How to use it: Provide package names and exact installed versions where known. Start with a dry run; structured library checks can work without AI.
Who runs it: Node.js service setup, current inventory and someone to review alerts.
What to know: Experimental alpha. It does not patch software or prove a system is safe. Missing versions, unsupported ranges and product-name matches require review.

ShieldaAI Apache-2.0

Get started GitHub Plan with this tool

Guidance & checklists

Know what to look for with OWASP

These references explain risks, safer implementation and verification requirements. Use them to plan a review and interpret scanner findings.

OWASP Top 10

Understand major web application risks and use them to frame a conversation with your developer. This is an awareness guide, not a scanner or a complete test plan.

Read the guide

OWASP Cheat Sheet Series

Find practical implementation guidance for authentication, access control, secrets, AI agents and other specific security topics.

Read the guide

OWASP ASVS

Turn application security into a defined set of requirements and verification tasks. Select the scope with your developer or reviewer and record the evidence.

Read the guide

Shielda maintains the projects labeled “By Shielda” and publishes this guide. Listings describe upstream project documentation; they are not independent security certifications.

Need a complete stack?