Dynamic, static, dependency, penetration, and application-security testing tools.
B
Bright Security
Use case: Run developer-focused dynamic security tests against web applications and APIs.
Type: Commercial dynamic application security testing platform
Access: Free trial and paid plans
What It Does
According to the vendor or project, the tool's stated purpose is to run developer-focused dynamic security tests against web applications and APIs.
Positive Community Commentary
Developer-focused security teams value Bright for running dynamic tests against web applications and APIs early in the delivery process. Practitioners often mention its developer-friendly findings, CI integrations, authentication handling, and ability to target changed functionality, which help teams make DAST a repeatable part of normal engineering workflows.
Things to Know
- Product or project type: Commercial dynamic application security testing platform.
- Current access model: Free trial and paid plans.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Bright Security website
Information checked: August 5, 2026
Back to top
Bugcrowd
Use case: Manage bug bounty, vulnerability disclosure, and penetration-testing programs.
Type: Commercial crowdsourced security platform
Access: Contact vendor for pricing
What It Does
According to the vendor or project, the tool's stated purpose is to manage bug bounty, vulnerability disclosure, and penetration-testing programs.
Positive Community Commentary
Security leaders value Bugcrowd for connecting organizations with a managed community of researchers and coordinating scope, submissions, triage, rewards, and vulnerability disclosure. Practitioners often highlight the diversity of researcher techniques and the platform’s operational support as useful for finding issues that automated tools and scheduled assessments may not uncover.
Things to Know
- Product or project type: Commercial crowdsourced security platform.
- Current access model: Contact vendor for pricing.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Bugcrowd website
Information checked: August 5, 2026
Back to top
Burp Suite
Use case: Inspect, test, scan, and manipulate web application traffic.
Type: Web application security testing platform
Access: Free Community Edition and paid editions
What It Does
According to the vendor or project, the tool's stated purpose is to inspect, test, scan, and manipulate web application traffic.
Positive Community Commentary
Web-security practitioners value Burp Suite for its intercepting proxy, request editor, repeater, intruder, scanner, extensions, and finely controlled manual workflow. Its large training and extension ecosystem makes it a common workbench for understanding application behavior, reproducing findings, testing APIs, and combining human investigation with automation.
Things to Know
- Product or project type: Web application security testing platform.
- Current access model: Free Community Edition and paid editions.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Burp Suite website
Information checked: August 5, 2026
Back to top
C
Checkmarx
Use case: Analyze source code, dependencies, infrastructure code, APIs, and applications for security issues.
Type: Commercial application-security platform
Access: Contact vendor for pricing
What It Does
According to the vendor or project, the tool's stated purpose is to analyze source code, dependencies, infrastructure code, APIs, and applications for security issues.
Positive Community Commentary
Enterprise application-security teams value Checkmarx for bringing static analysis, software-composition analysis, infrastructure checks, API security, and centralized policy into development workflows. Reviewers often mention broad language coverage, IDE and CI integrations, reporting, and governance as useful for coordinating security testing across large portfolios.
Things to Know
- Product or project type: Commercial application-security platform.
- Current access model: Contact vendor for pricing.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Checkmarx website
Information checked: August 5, 2026
Back to top
CodeQL
Use case: Query source code as data to identify security vulnerabilities and coding problems.
Type: Semantic code-analysis engine
Access: Free for research and open source; commercial use through GitHub
What It Does
According to the vendor or project, the tool's stated purpose is to query source code as data to identify security vulnerabilities and coding problems.
Positive Community Commentary
Security engineers value CodeQL for treating code as queryable data and expressing vulnerability patterns with reusable semantic queries. Practitioners often highlight its deep interprocedural analysis, public query libraries, GitHub integration, and usefulness for variant analysis, allowing teams to search many repositories for related flaws with transparent logic.
Things to Know
- Product or project type: Semantic code-analysis engine.
- Current access model: Free for research and open source; commercial use through GitHub.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the CodeQL website
Information checked: August 5, 2026
Back to top
Coverity
Use case: Analyze source code for security, reliability, and quality defects.
Type: Commercial static application security testing tool
Access: Contact vendor for pricing
What It Does
According to the vendor or project, the tool's stated purpose is to analyze source code for security, reliability, and quality defects.
Positive Community Commentary
Large development organizations value Coverity for mature static analysis across C, C++, Java, C#, and other languages, with path-sensitive findings and centralized triage. Practitioners often highlight its ability to identify reliability and security defects in substantial codebases and track issue history across repeated analysis runs.
Things to Know
- Product or project type: Commercial static application security testing tool.
- Current access model: Contact vendor for pricing.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Coverity website
Information checked: August 5, 2026
Back to top
G
GitHub Advanced Security
Use case: Add code scanning, secret scanning, dependency analysis, and security campaigns to GitHub repositories.
Type: Commercial application-security platform
Access: Paid GitHub add-on
What It Does
According to the vendor or project, the tool's stated purpose is to add code scanning, secret scanning, dependency analysis, and security campaigns to GitHub repositories.
Positive Community Commentary
GitHub teams value Advanced Security for code scanning, secret scanning, dependency review, security campaigns, and remediation guidance directly within repositories and pull requests. Practitioners often highlight the reduced context switching and ability to assign, suppress, query, and track findings alongside the code and developers responsible for changes.
Things to Know
- Product or project type: Commercial application-security platform.
- Current access model: Paid GitHub add-on.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the GitHub Advanced Security website
Information checked: August 5, 2026
Back to top
Gitleaks
Use case: Detect hard-coded secrets in Git repositories, files, and CI pipelines.
Type: Open-source secret-scanning tool
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to detect hard-coded secrets in Git repositories, files, and CI pipelines.
Positive Community Commentary
DevSecOps practitioners value Gitleaks for fast secret detection across Git history, working trees, files, containers, pre-commit hooks, and CI pipelines. Users appreciate its clear rules, allowlists, custom configuration, and portable binary, which make it practical to prevent credentials from reaching repositories and to audit existing codebases.
Things to Know
- Product or project type: Open-source secret-scanning tool.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Gitleaks website
Information checked: August 5, 2026
Back to top
gosec
Use case: Scan Go source code for security-related coding patterns.
Type: Go static application-security analyzer
Access: Free and open source
What It Does
gosec is an open-source Go static application security testing tool that analyzes Go source code and selected data flows for security-related patterns.
Positive Community Commentary
It scans Go code for security-related patterns and can run as part of automated security checks.
Things to Know
- Static findings require triage and do not establish that an application is secure.
- Review the official page for current platforms, integrations, licensing, and product changes.
Visit the gosec website
Information checked: October 14, 2026
Back to top
H
HCL AppScan
Use case: Perform static, dynamic, interactive, and software-composition security testing.
Type: Commercial application-security testing platform
Access: Free trial and paid plans
Also known as: IBM Application Security APPScan
What It Does
According to the vendor or project, the tool's stated purpose is to perform static, dynamic, interactive, and software-composition security testing.
Positive Community Commentary
Enterprise security teams value AppScan for combining static, dynamic, interactive, API, mobile, and composition analysis under shared policies and reporting. Practitioners often highlight its broad testing coverage, remediation information, and integration options when organizations need standardized application-security processes across varied technology stacks.
Things to Know
- Product or project type: Commercial application-security testing platform.
- Current access model: Free trial and paid plans.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the HCL AppScan website
Information checked: August 5, 2026
Back to top
K
Kali Linux
Use case: Provide a curated operating system and toolset for penetration testing, forensics, and security research.
Type: Open-source security testing Linux distribution
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to provide a curated operating system and toolset for penetration testing, forensics, and security research.
Positive Community Commentary
Security practitioners value Kali Linux for providing a maintained, reproducible distribution with a broad collection of penetration-testing, forensics, wireless, web, network, and reverse-engineering tools. Its documentation, images, package management, and large community make it a familiar foundation for authorized labs, assessments, training, and research.
Things to Know
- Product or project type: Open-source security testing Linux distribution.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Kali Linux website
Information checked: August 5, 2026
Back to top
M
Metasploit
Use case: Develop, test, and execute exploit modules during authorized security assessments.
Type: Penetration-testing framework
Access: Free open-source edition and commercial edition
What It Does
According to the vendor or project, the tool's stated purpose is to develop, test, and execute exploit modules during authorized security assessments.
Positive Community Commentary
Penetration testers value Metasploit for its extensive modules, payloads, encoders, sessions, auxiliary scanners, and repeatable exploitation workflow. Practitioners use it in authorized assessments and labs to validate exposure, demonstrate impact, test defensive controls, and build reusable modules around newly understood techniques.
Things to Know
- Product or project type: Penetration-testing framework.
- Current access model: Free open-source edition and commercial edition.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Metasploit website
Information checked: August 5, 2026
Back to top
MobSF
Use case: Perform static and dynamic security analysis of mobile applications.
Type: Open-source mobile security testing framework
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to perform static and dynamic security analysis of mobile applications.
Positive Community Commentary
Mobile-security practitioners value MobSF for bringing Android, iOS, and Windows static analysis, dynamic testing, privacy checks, and malware-oriented inspection into one web interface and API. Users often highlight its containerized setup, comprehensive reports, and automation options as useful for quickly triaging mobile builds and integrating checks into delivery workflows.
Things to Know
- Product or project type: Open-source mobile security testing framework.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the MobSF website
Information checked: October 12, 2026
Back to top
N
Nikto
Use case: Check web servers for dangerous files, outdated components, and configuration issues.
Type: Open-source web server scanner
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to check web servers for dangerous files, outdated components, and configuration issues.
Positive Community Commentary
Security testers value Nikto for quick web-server checks covering dangerous files, outdated components, common configuration issues, headers, and server behavior. Practitioners often use its scriptable command-line interface and multiple report formats as an early reconnaissance step that complements deeper application testing.
Things to Know
- Product or project type: Open-source web server scanner.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Nikto website
Information checked: August 5, 2026
Back to top
Nuclei
Use case: Run template-based security checks against applications, APIs, networks, and cloud systems.
Type: Open-source vulnerability scanner
Access: Free and open source with commercial services
What It Does
According to the vendor or project, the tool's stated purpose is to run template-based security checks against applications, APIs, networks, and cloud systems.
Positive Community Commentary
Security practitioners value Nuclei for fast, template-driven checks across web applications, APIs, networks, cloud assets, and exposed technologies. Its active template community, flexible matchers, workflows, severity metadata, and pipeline-friendly CLI make it useful for repeatable reconnaissance and organization-specific security checks at scale.
Things to Know
- Product or project type: Open-source vulnerability scanner.
- Current access model: Free and open source with commercial services.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Nuclei website
Information checked: August 5, 2026
Back to top
O
OpenText Fortify on Demand
Use case: Provide managed static, dynamic, mobile, and software-composition security testing.
Type: Commercial application-security testing service
Access: Contact vendor for pricing
Also known as: HP (now Micro Focus) Fortify On Demand
What It Does
According to the vendor or project, the tool's stated purpose is to provide managed static, dynamic, mobile, and software-composition security testing.
Positive Community Commentary
Organizations value Fortify on Demand for managed static, dynamic, mobile, and composition testing without operating the full scanning infrastructure themselves. Practitioners often highlight centralized policies, expert review, remediation guidance, integrations, and portfolio reporting as useful for scaling application-security coverage across many teams.
Things to Know
- Product or project type: Commercial application-security testing service.
- Current access model: Contact vendor for pricing.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the OpenText Fortify on Demand website
Information checked: August 5, 2026
Back to top
OWASP Amass
Use case: Discover external assets and map attack surfaces using open-source intelligence and network data.
Type: Open-source attack-surface mapping tool
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to discover external assets and map attack surfaces using open-source intelligence and network data.
Positive Community Commentary
Attack-surface practitioners value Amass for combining passive and active discovery, DNS intelligence, graph relationships, and asset databases to map an organization’s external footprint. Users often highlight its depth, automation, and open data model when building repeatable reconnaissance workflows and identifying domains, addresses, infrastructure, and ownership connections.
Things to Know
- Product or project type: Open-source attack-surface mapping tool.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the OWASP Amass website
Information checked: August 5, 2026
Back to top
OWASP Dependency-Check
Use case: Identify publicly disclosed vulnerabilities in project dependencies.
Type: Open-source software-composition analysis tool
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to identify publicly disclosed vulnerabilities in project dependencies.
Positive Community Commentary
Development teams value Dependency-Check for identifying known vulnerabilities in third-party components through an open-source, build-friendly workflow. Practitioners often use its Maven, Gradle, command-line, Jenkins, and other integrations to generate repeatable reports and add dependency checks to established pipelines without adopting a hosted platform.
Things to Know
- Product or project type: Open-source software-composition analysis tool.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the OWASP Dependency-Check website
Information checked: August 5, 2026
Back to top
OWASP Dependency-Track
Use case: Analyze software bills of materials and track component vulnerabilities and policy risks.
Type: Open-source software supply-chain risk platform
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to analyze software bills of materials and track component vulnerabilities and policy risks.
Positive Community Commentary
Software-supply-chain teams value Dependency-Track for ingesting SBOMs, correlating component vulnerabilities, applying policies, tracking affected projects, and notifying responsible teams. Practitioners often highlight its API-first design, portfolio visibility, and support for continuous BOM analysis as strengths for operating an open-source component-risk program.
Things to Know
- Product or project type: Open-source software supply-chain risk platform.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the OWASP Dependency-Track website
Information checked: August 5, 2026
Back to top
S
Semgrep
Use case: Scan source code for security issues, bugs, and organization-specific coding rules.
Type: Static analysis and application-security platform
Access: Free open-source engine and paid platform
What It Does
According to the vendor or project, the tool's stated purpose is to scan source code for security issues, bugs, and organization-specific coding rules.
Positive Community Commentary
Developers and security engineers value Semgrep for fast, readable pattern rules, broad language support, local or CI execution, and the ability to encode organization-specific secure-coding knowledge. Practitioners often highlight quick feedback, easy custom rules, and dataflow analysis as useful for finding both security issues and recurring code defects.
Things to Know
- Product or project type: Static analysis and application-security platform.
- Current access model: Free open-source engine and paid platform.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Semgrep website
Information checked: August 5, 2026
Back to top
Snyk
Use case: Scan code, open-source dependencies, containers, and infrastructure definitions for security issues.
Type: Commercial developer-security platform
Access: Free and paid plans
What It Does
According to the vendor or project, the tool's stated purpose is to scan code, open-source dependencies, containers, and infrastructure definitions for security issues.
Positive Community Commentary
Development teams value Snyk for scanning open-source dependencies, source code, containers, and infrastructure definitions within IDEs, repositories, and pipelines. Reviewers often mention actionable remediation, fix pull requests, developer-friendly integrations, and portfolio visibility as useful for moving security work closer to normal engineering decisions.
Things to Know
- Product or project type: Commercial developer-security platform.
- Current access model: Free and paid plans.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Snyk website
Information checked: August 5, 2026
Back to top
SonarQube
Use case: Analyze source code for reliability, maintainability, and security issues.
Type: Static code-analysis platform
Access: Free Community Build and paid editions
What It Does
According to the vendor or project, the tool's stated purpose is to analyze source code for reliability, maintainability, and security issues.
Positive Community Commentary
Engineering teams value SonarQube for consistent static analysis of reliability, maintainability, and security issues across many languages. Practitioners often highlight quality gates, pull-request feedback, issue explanations, duplication and coverage reporting, and customizable rules as useful for making code-quality expectations visible and enforceable throughout delivery.
Things to Know
- Product or project type: Static code-analysis platform.
- Current access model: Free Community Build and paid editions.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the SonarQube website
Information checked: August 5, 2026
Back to top
sqlmap
Use case: Detect and exploit SQL injection vulnerabilities during authorized security testing.
Type: Open-source penetration-testing tool
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to detect and exploit SQL injection vulnerabilities during authorized security testing.
Positive Community Commentary
Authorized security testers value sqlmap for automating detection and validation of many SQL injection techniques across numerous databases and request formats. Practitioners appreciate its depth, tamper scripts, session handling, request-file support, and detailed controls, which make it a standard tool for confirming and characterizing suspected injection behavior in approved assessments.
Things to Know
- Product or project type: Open-source penetration-testing tool.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the sqlmap website
Information checked: August 5, 2026
Back to top
StackHawk
Use case: Run automated web application and API security tests in development pipelines.
Type: Commercial dynamic application security testing platform
Access: Free trial and paid plans
What It Does
According to the vendor or project, the tool's stated purpose is to run automated web application and API security tests in development pipelines.
Positive Community Commentary
Application teams value StackHawk for running web and API dynamic tests from CI using configuration stored with the code. Practitioners often highlight developer-readable findings, environment-specific scanning, authentication support, OpenAPI integration, and issue tracking as useful for turning DAST into an ordinary, repeatable pipeline activity.
Things to Know
- Product or project type: Commercial dynamic application security testing platform.
- Current access model: Free trial and paid plans.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the StackHawk website
Information checked: August 5, 2026
Back to top
T
Trivy
Use case: Scan container images, filesystems, repositories, Kubernetes, and infrastructure code for vulnerabilities and misconfigurations.
Type: Open-source security scanner
Access: Free and open source
What It Does
According to the vendor or project, the tool's stated purpose is to scan container images, filesystems, repositories, Kubernetes, and infrastructure code for vulnerabilities and misconfigurations.
Positive Community Commentary
Cloud-native teams value Trivy for a single, fast scanner covering container images, repositories, filesystems, Kubernetes, SBOMs, secrets, licenses, and infrastructure misconfigurations. Practitioners often highlight its simple CLI, broad integrations, clear database updates, and CI suitability as reasons it is widely used in container and supply-chain workflows.
Things to Know
- Product or project type: Open-source security scanner.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Trivy website
Information checked: August 5, 2026
Back to top
V
Veracode
Use case: Perform static, dynamic, composition, and penetration testing for software applications.
Type: Commercial application-risk management platform
Access: Contact vendor for pricing
What It Does
According to the vendor or project, the tool's stated purpose is to perform static, dynamic, composition, and penetration testing for software applications.
Positive Community Commentary
Enterprise application-security programs value Veracode for static, dynamic, composition, and penetration-testing services supported by policy, reporting, and developer integrations. Reviewers often highlight centralized governance, remediation guidance, and broad portfolio visibility as useful for coordinating security expectations across many applications and suppliers.
Things to Know
- Product or project type: Commercial application-risk management platform.
- Current access model: Contact vendor for pricing.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the Veracode website
Information checked: August 5, 2026
Back to top
Z
ZAP
Use case: Proxy, inspect, crawl, and scan web applications and APIs during authorized testing.
Type: Open-source web application security testing tool
Access: Free and open source
Also known as: Zap
What It Does
According to the vendor or project, the tool's stated purpose is to proxy, inspect, crawl, and scan web applications and APIs during authorized testing.
Positive Community Commentary
Web-security testers and developers value ZAP for its intercepting proxy, spidering, passive and active scanning, scripting, API, automation framework, and add-on ecosystem. Its open-source model and extensive documentation make it a common choice for learning, manual investigation, API testing, and repeatable CI security scans.
Things to Know
- Product or project type: Open-source web application security testing tool.
- Current access model: Free and open source.
- Review the official page for current platforms, integrations, system requirements, licensing, and product changes.
Visit the ZAP website
Information checked: August 5, 2026
Back to top
zizmor
Use case: Statically analyze GitHub Actions and related CI/CD configuration for security issues.
Type: Open-source CI/CD static-analysis tool
Access: Free and open source
What It Does
According to the project, zizmor statically analyzes GitHub Actions, Dependabot, and pre-commit configuration. It identifies security risks in CI/CD workflows and provides documented audit rules and integrations.
Positive Community Commentary
zizmor fills a useful gap between application-security scanning and CI/CD security review. It is particularly relevant for identifying unsafe workflow permissions, untrusted input handling, and action-supply-chain risks.
Things to Know
- Product or project type: Static-analysis tool for CI/CD configuration.
- Current access model: Free and open source.
- Supports installation through multiple package-manager routes.
- Provides integrations for GitHub Actions, pre-commit, and IDE workflows.
- Security findings should be reviewed in the context of the project’s workflow design.
- Review the official documentation for current audit rules, supported formats, and integrations.
Visit the zizmor website
Information checked: September 21, 2026
Back to top
