A free Python command-line tool that checks a website's HTTPS certificate and tells you exactly what's wrong with it — expired, untrusted, wrong hostname — instead of a generic connection error.
github.com
Alternatives to
Exploitarium
Best alternatives to Exploitarium in 2026
Security professionals learn to defend systems partly by studying how systems actually get broken, but that research is normally scattered across blog posts, conference talks and disclosure databases with no consistent format. Exploitarium collects that knowledge in one place: over 47 proof-of-concept folders covering disclosed vulnerabilities in real, well-known software, each with a technical writeup explaining what the flaw was and how it was exploited. Exploitarium is a curated, open-source GitHub archive covering vulnerabilities across web applications (Discourse, Nextcloud, Gitea), system software (Firefox, OpenSSH, Docker, QEMU), libraries (FFmpeg, ImageMagick, libssh2) and communication platforms (Discord), written in a mix of C, Python and shell scripts. It's built around a responsible-disclosure and good-faith-research framing, with the maintainer citing a background in fuzzing methodology and published security research, and it carries an explicit anti-malicious-use disclaimer. With over 4,600 GitHub stars, 1,300 forks and 113 watchers, it's an actively followed reference rather than an obscure repository, and it functions as a study resource similar in spirit to Exploit-DB or PoC-in-GitHub, but organized as a browsable, contribution-friendly project rather than a raw database dump.
Quick comparison of Exploitarium alternatives
| # | Tool | Best for | Price |
|---|---|---|---|
| 1 | Équipes DevOps/SRE et administrateurs système voulant un moniteur d'expiration de certificat sans dépendance pour cron/CI | — | |
| 2 | Équipes construisant des applications LLM soumises à des exigences de conformité (RGPD, AI Act) et de protection des données | — | |
| 3 | Développeurs et petites équipes voulant committer des secrets chiffrés dans Git sans gestionnaire cloud | — | |
| 4 | Développeurs et équipes sécurité utilisant des agents IA (Claude Code, MCP, LangChain, CrewAI, AutoGen) avec des skills/plugins tiers | — | |
| 5 | Consommateurs en ligne voulant vérifier l'authenticité d'une boutique avant d'acheter | — | |
| 6 | Chasseurs de bug bounty, chercheurs en sécurité, équipes de sécurité, pentesters, ingénieurs DevSecOps | — | |
| 7 | Fondateurs non-techniques, indie hackers, builders utilisant Lovable/Bolt/Cursor/Replit, petites équipes qui livrent vite, étudiants et débutants en code | — | |
| 8 | Développeurs et équipes DevOps/sécurité voulant un WAF auto-hébergé pour projets personnels ou non-commerciaux | — | |
| 9 | Petits cabinets médicaux/dentaires et centres de santé communautaires américains recevant Medicare/Medicaid | — | |
| 10 | Développeurs utilisant des agents de code IA (Claude Code, Codex) sur des systèmes sensibles ou sous contrainte de conformité | — | |
| 11 | Ingénieurs DevOps, équipes sécurité et développeurs gérant des dépendances logicielles | — | |
| 12 | Équipes de développement qui produisent beaucoup de code généré par des assistants IA (Claude, Copilot, Cursor, Gemini...) | — |
#1
- ✓ Zero dependencies, easy to drop into bare servers or containers
- ✓ Detailed diagnostics rather than a generic 'connection failed'
#2
An open-source trust-boundary gateway that sits in front of OpenAI, Anthropic and Gemini API traffic to redact PII, enforce rate limits, and track usage without touching your app code.
github.com
- ✓ Single gateway covering OpenAI, Anthropic and Gemini without SDK changes
- ✓ Comprehensive PII detection and redaction
#3
A free command-line tool that encrypts your .env secrets file so you can safely commit it to Git, with a pre-commit hook that catches accidental leaks before they happen.
github.com
- ✓ Genuinely zero-config: one command sets up encryption plus a pre-commit safety net
- ✓ No external dependencies or cloud service required
#4
A security scanner that formally verifies AI agent "skills" (tools/plugins) across 22 frameworks for supply-chain risks before you trust them.
github.com
- ✓ Scans 22 AI agent frameworks in one pass
- ✓ Generates HTML dashboards, lockfiles, and ASBOM documents for compliance
#5
A free scanner and Chrome extension that checks an online store for signs it's an AI-generated or fraudulent storefront before you buy anything.
bullsniff.com
- ✓ Completely free, no account required for the base scan
- ✓ Checks multiple independent trust signals, not just page content
#6
A free, self-hostable security scanner that checks web apps, mobile apps, and smart contracts for vulnerabilities, with AI-written fix instructions.
bugbounty-arsenal.net
- ✓ Broad coverage (web, mobile, Web3 smart contracts) with no license fee
- ✓ "Confirmed" findings model reduces false positives
#7
A security scanner built for people who use AI to write their code and have no idea whether it's leaking API keys or open to attack.
vibesafe.info
- ✓ Scan complet en moins de 10 secondes, sans configuration
- ✓ Rapports en langage clair avec correctif en un clic
#8
A firewall that sits in front of your website and inspects every request for common attacks — SQL injection, cross-site scripting and the like — before it ever reaches your app.
github.com
- ✓ Très faible latence (Rust + Pingora, p99 1.60ms)
- ✓ Couvre les vecteurs d'attaque web classiques (OWASP Core Rule Set + règles custom)
#9
A flat-fee compliance package that brings a healthcare provider's website and patient portal up to Section 1557 accessibility standards before the 2027 federal deadline.
health.civicbinder.org
- ✓ Flat, predictable price instead of open-ended hourly consulting
- ✓ Bundles audit + legal documents + remediation plan in one package
#10
Puts a human approval gate in front of risky Claude Code / Codex actions, with secret redaction and replayable audit trails.
github.com
- ✓ Adds a genuine approval checkpoint before risky agent actions execute
- ✓ Automatic secret/credential redaction reduces accidental leak risk
#11
A local-first security scanner that checks your project's open-source dependencies for malicious packages and known vulnerabilities without sending your code anywhere.
github.com
- ✓ Huit moteurs de scan concurrents, dont des modèles IA pour la détection avancée
- ✓ Couvre neuf écosystèmes de paquets (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems, HuggingFace, GitHub Actions)
#12
Scans AI-generated code for hardcoded secrets and exploitable vulnerabilities, with AI-filtered false positives
sentrint.com
- ✓ Palier gratuit sans carte bancaire, avec rapport complet et suggestions de correction par IA
- ✓ Compatible avec 16+ plateformes IA, avec prompts de correction adaptés à chaque outil
FAQ about Exploitarium alternatives
- What is the best alternative to Exploitarium in 2026?
- Based on our selection, TLS Sentry is the best alternative to Exploitarium in 2026. A free Python command-line tool that checks a website's HTTPS certificate and tells you exactly what's wrong with it — expired, untrusted, wrong hostname — instead of a generic connection error.. See our full ranking above to compare all options.
- Is Exploitarium free?
- Exploitarium is a paid tool. Several alternatives in our selection offer free or freemium versions.
- How many alternatives to Exploitarium are there?
- mySelectas has listed 12 alternatives to Exploitarium in the Security & Privacy category. Our selection is updated regularly to include the best options available.