#vulnerability-scanning

BugBounty Arsenal

A free, self-hostable security scanner that checks web apps, mobile apps, and smart contracts for vulnerabilities, with AI-written fix instructions.

VibeSafe

A security scanner built for people who use AI to write their code and have no idea whether it's leaking API keys or open to attack.

Sentrint

Scans AI-generated code for hardcoded secrets and exploitable vulnerabilities, with AI-filtered false positives

MCP Security Auditor

Zero-execution static scanner that audits MCP servers for command injection, path traversal and prompt injection

SecURL

Free automated security grading tool that checks a website's external security posture.

Husk

A local-first security scanner that checks your machine for compromised packages, leaked secrets, and risky AI/MCP configs, no cloud, no login.

Railo

A tool that automatically opens pull requests with deterministic, proof-verified security patches instead of just flagging issues.

VulnScout

Takes the list of every open-source component your software depends on (its SBOM) and tells you which ones have known security holes, then gives you a web dashboard to triage and report on them — rather than making you cross-reference vulnerability databa

IntelOwl

When a suspicious IP address, file, or link crosses an analyst's desk, checking it properly means querying a dozen different services (VirusTotal, Shodan, MISP...) one by one. IntelOwl does all those lookups at once through a single dashboard, for free.

DefectDojo

A security team running five different scanners (one for containers, one for code, one for dependencies...) ends up with five different spreadsheets of findings, half of them duplicates. DefectDojo pulls all of that into one place, removes the duplicates,

Vigolium

A free, open-source vulnerability scanner that combines fast, deterministic security checks with an optional AI agent that plans and triages findings on its own — built for penetration testers and security teams who want automation without losing precisio

CVE Lite CLI

A free, open-source OWASP project that scans your project's lockfile for known vulnerabilities and hands you copy-and-run fix commands — dependency security that lives in your terminal instead of buried in a CI dashboard you check once a week.

VulX

Scans AI-generated codebases for exposed keys, vulnerable dependencies, and authorization flaws, with plain-English fixes.

Thoropass

A compliance platform that pairs automated evidence-gathering software with actual licensed auditors on staff, so the same company that helps you prepare for SOC 2 or ISO 27001 can also perform the audit itself.

Secureframe

Automates the grinding paperwork behind security certifications like SOC 2 or ISO 27001 — connecting to your cloud tools, continuously collecting the evidence an auditor needs, and flagging anything that would fail before the real audit happens.

Tailsnitch

Free open-source tool that scans a Tailscale network for security misconfigurations — overly open access rules, weak auth settings, risky device permissions — and tells you exactly what to fix.

Cycode

A security platform that scans your code, pipelines, and AI coding tools for vulnerabilities across your whole software supply chain, then tries to auto-fix what it finds.

Betterleaks

Free secrets scanner from Gitleaks' original creator: finds leaked API keys and passwords in code with far fewer false positives.

CodeAnt AI

AI-powered security platform combining automated pentesting, code review and cloud vulnerability scanning to find and fix exploitable issues before attackers do.

promptfoo

Open-source LLM eval and red teaming: test prompts, compare models, catch jailbreaks and data leaks locally and in CI.