Modern software is built from hundreds of open-source packages, and any one of them can quietly carry a known vulnerability. Regulations and big customers increasingly ask for an SBOM — a software bill of materials, basically an ingredients list — but having the list isn't the same as knowing which ingredients are actually dangerous right now. VulnScout reads that ingredients list and cross-checks it against vulnerability databases automatically, the way a nutrition app scans a barcode and tells you about allergens instead of making you read the label yourself. VulnScout is an open-source (GPL-3.0) tool from Savoir-faire Linux that ingests SBOMs in multiple formats (SPDX 2/3, CycloneDX, Yocto CVE, OpenVEX) and enriches them with vulnerability data from the NVD, EPSS, and Grype. It provides a web-based triage interface, project/variant management for tracking multiple software builds, CI/CD integration with configurable pass/fail conditions, and report generation in AsciiDoc, HTML, PDF, or CSV — useful for both internal review and compliance documentation. It deploys via Docker and supports organization-specific CVSS scoring adjustments.
| # | Tool | Best for | Price |
|---|---|---|---|
| 1 | Équipes AppSec/sécurité qui font tourner plusieurs scanners (SAST, DAST, conteneurs, dépendances...) et veulent centraliser les résultats | — | |
| 2 | Développeurs | — | |
| 3 | Développeurs | — | |
| 4 | Développeurs et équipes utilisant Claude Desktop ou Cursor avec des serveurs MCP tiers, soucieux de la sécurité des appels d'outils IA | — | |
| 5 | Site owners and developers managing AI crawler access | — | |
| 6 | Privacy-conscious users wanting model-agnostic AI access from their browser | — | |
| 7 | Developers wanting privacy/consent management integrated into their codebase | — | |
| 8 | IT/DevOps teams replacing corporate VPNs with Zero Trust access | — | |
| 9 | Businesses needing GDPR-compliant, frictionless bot protection | — | |
| 10 | Organisations d'ingénierie, équipes sécurité/conformité adoptant des agents de code IA | — | |
| 11 | Équipes MCP/API et sécurité déployant des agents IA | — | |
| 12 | Équipes DevOps/SRE et administrateurs système voulant un moniteur d'expiration de certificat sans dépendance pour cron/CI | — |
A security team running five different scanners (one for containers, one for code, one for dependencies...) ends up with five different spreadsheets of findings, half of them duplicates. DefectDojo pulls all of that into one place, removes the duplicates,
macOS app that intercepts and audits MCP server traffic between Claude Desktop or Cursor and connected tools for security oversight.
Free, in-browser generator for robots.txt and llms.txt files that control which AI crawlers can access your site.
Privacy-first browser side panel AI assistant that works with any model or agent and anonymizes sensitive data before it leaves your browser.
Open-source, developer-first privacy and cookie-consent infrastructure with headless consent flows and version-controlled policies.
Open-source WireGuard-based mesh VPN that replaces traditional VPNs with Zero Trust, identity-based device access.
Invisible, privacy-first bot protection using proof-of-work instead of visual puzzles.
Enterprise policy-enforcement layer that watches what coding agents do — prompts, commands, file changes — and blocks or alerts on sensitive data exposure.
Authorization layer that checks every AI agent action against a policy before it runs, with per-action revocation and a full audit trail.
A free Python command-line tool that checks a website's HTTPS certificate and tells you exactly what's wrong with it — expired, untrusted, wrong hostname — instead of a generic connection error.
