Modern software is built from hundreds of open-source packages, and any one of them can quietly carry a known vulnerability. Regulations and big customers increasingly ask for an SBOM — a software bill of materials, basically an ingredients list — but having the list isn't the same as knowing which ingredients are actually dangerous right now. VulnScout reads that ingredients list and cross-checks it against vulnerability databases automatically, the way a nutrition app scans a barcode and tells you about allergens instead of making you read the label yourself. VulnScout is an open-source (GPL-3.0) tool from Savoir-faire Linux that ingests SBOMs in multiple formats (SPDX 2/3, CycloneDX, Yocto CVE, OpenVEX) and enriches them with vulnerability data from the NVD, EPSS, and Grype. It provides a web-based triage interface, project/variant management for tracking multiple software builds, CI/CD integration with configurable pass/fail conditions, and report generation in AsciiDoc, HTML, PDF, or CSV — useful for both internal review and compliance documentation. It deploys via Docker and supports organization-specific CVSS scoring adjustments.
| # | Tool | Best for | Price |
|---|---|---|---|
| 1 | Équipes AppSec/sécurité qui font tourner plusieurs scanners (SAST, DAST, conteneurs, dépendances...) et veulent centraliser les résultats | — | |
| 2 | Développeurs | — | |
| 3 | Développeurs | — | |
| 4 | Startups et équipes sécurité/conformité qui visent une certification (SOC 2, ISO 27001...) sans payer le prix d'un Vanta/Drata | — | |
| 5 | Utilisateurs Windows qui veulent un gestionnaire de mots de passe entièrement hors-ligne, sans dépendance cloud | — | |
| 6 | Analystes SOC et équipes threat intelligence qui veulent automatiser l'analyse d'IOC (IP, domaines, fichiers, hash) via de nombreuses sources à la fois | — | |
| 7 | Particuliers et organisations soucieux de vie privée qui veulent un stockage cloud auto-hébergé avec chiffrement réellement côté client | — | |
| 8 | Chercheurs en sécurité, pentesters, chasseurs de bug bounty et équipes dev réalisant des audits de sécurité | — | |
| 9 | Équipes de sécurité en entreprise et chercheurs menant des revues de sécurité whitebox sur du code source | — | |
| 10 | Développeurs JavaScript/TypeScript qui veulent un scan de vulnérabilités des dépendances directement en local avant de pousser du code | — | |
| 11 | Particuliers et équipes qui veulent gérer leurs codes 2FA depuis un serveur auto-hébergé plutôt qu'un seul téléphone | — | |
| 12 | Développeurs et administrateurs homelab voulant un SSO simple, sans mot de passe, pour leurs applications auto-hébergées | — |
A security team running five different scanners (one for containers, one for code, one for dependencies...) ends up with five different spreadsheets of findings, half of them duplicates. DefectDojo pulls all of that into one place, removes the duplicates,
Getting SOC 2 or ISO 27001 certified means proving, with evidence, that your policies match reality — normally a spreadsheet nightmare or a $10k-a-year SaaS subscription (Vanta, Drata). Openlane does the same evidence-collection and tracking job as open-s
A password manager that never talks to the internet at all — your vault, encrypted with AES-256, lives only on your Windows PC, so there's no cloud account to breach and no subscription to pay, at the cost of syncing to your phone.
When a suspicious IP address, file, or link crosses an analyst's desk, checking it properly means querying a dozen different services (VirusTotal, Shodan, MISP...) one by one. IntelOwl does all those lookups at once through a single dashboard, for free.
A self-hosted Google Drive/Dropbox alternative where files are encrypted in your browser before they ever reach the server — so even the machine storing your files never sees what's actually in them.
A free, open-source vulnerability scanner that combines fast, deterministic security checks with an optional AI agent that plans and triages findings on its own — built for penetration testers and security teams who want automation without losing precisio
A free, open-source, experimental framework from security firm Hadrian that turns a coding AI assistant like Claude Code or Cursor into a structured vulnerability-research team — complete with checkpointed progress and OWASP/MITRE-aligned expert agents.
A free, open-source OWASP project that scans your project's lockfile for known vulnerabilities and hands you copy-and-run fix commands — dependency security that lives in your terminal instead of buried in a CI dashboard you check once a week.
A free, open-source, self-hosted alternative to Google Authenticator — manage and generate your two-factor login codes from a web app you run yourself, on any device with a browser, instead of being tied to one phone.
A free, open-source, self-hosted login system for your other self-hosted apps, built entirely around passkeys — so nobody has to remember (or leak) a password ever again.
