Alternatives
Products that do what Arnica does
Behavior based software supply chain security
- 1
- 2
- 3VN
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com
- 4PQ
May 2026 · github.com
- 5
- 6DA
2014 · diffmatic.com
- 7IB
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com
- 8
- 9WB
Hi. We just open sourced Bullet Train, a Feature Flag and Remote Config platform. It's a collection of tools: server API, admin front end and clients for a bunch of different platforms. Together they allow you to control feature flags and remote config across projects, environments and users. We realised that we were building ad-hoc feature flag stuff into individual projects over and over, so we had a look around to see if there was a way of doing this in a more formal manner. There are a few commercial solutions around but they were quite expensive and seemed to be aimed more at the…
2018
- 10MA
2022 · github.com
- 11GA
GitHub Actions Goat is an open-source educational project that simulates common security attacks and vulnerabilities in a GitHub Actions CI/CD environment and shows how to defend against such attacks. This project is designed to be hands-on and interactive, offering ten meticulously crafted tutorials for security practitioners and developers. You can delve into the intricacies of GitHub Actions Security by forking the project and learning by doing. All you need to follow the hands-on tutorials is your GitHub Account.
2023 · github.com
- 12AC
I built this toolkit with my colleague to dive deep into OS internals and automate the identification of privilege escalation vectors. Written in pure C without external dependencies, it explores everything from Linux capabilities and Docker escapes to Windows token manipulation and service permissions. We believe that the constant struggle between breaking and securing systems is the ultimate driver of software evolution. This tool is our contribution to that cycle, designed for researchers who want to understand how low-level misconfigurations can be discovered and audited across different…
Jan 2026
- 13IB
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com
- 14
- 15IB
Hi HN, A lot of the dev teams I have worked with had a lot of issues with their documentation. In fact, some of my easiest clients to get were from clients that had "black box" solutions that devs no longer at the company had created. Personally, writing documentation is like grinding nails on a chalkboard. I have been having a lot of fun with building solutions that can run in a distributed way, not something a dev needs to run themselves. And after a significant amount of testing and building out several different solutions, I finally have a solution that is easy to set up and runs in the…
Dec 2025 · codesummary.io
- 16RU
hey all, happy to share research i've been working on for islo.dev in recent months. ever since the cheating agents (https://debugml.github.io/cheating-agents/) paper came out, revealing reward hacking was 4x more prevalent than previously estimated, i've been looking into how we can deal with the issue the common approach (taken by the tbench team) is post hoc trajectory analysis. i've been interested in the idea of reframing the problem as an endpoint security problem and tackling it via sandbox i hope you find it interesting, and thanks to the islo.dev team for…
Jun 2026 · github.com
- 17WV
Honeytoken technology is becoming more and more important in the world of supply chain security. SaaS-Sentinel is an alerting platform based on this technology to notify subscribers when a honeytoken planted in a SaaS provider was triggered. This is the story of the project.
2023 · blog.gitguardian.com
- 18AA
Hey HN, Staff Engineer at Ably here. Over the past few months I've been speaking to engineers building AI assistants, copilots, and agentic workflows (over 40 companies at this point), with particular focus on cloud-hosted agents. I expected the hard problems to be in model selection, prompt engineering, and orchestration. Instead, the same infrastructure challenges kept coming up: realtime sync between agents and end clients is surprisingly painful to get right. - Managing and scaling WebSocket or SSE connections between agents and clients - Buffering messages server-side and implementing…
Jan 2026 · ably.com
- 19
Catch Malicious npm and PyPI Packages by Their Behavior
25d ago · tazarsec.dev
- 20TO
I built DevClaw, an OpenClaw plugin that turns each Telegram group into an isolated, autonomous dev team: planner/orchestrator, DEVs, and QA all running on their own. I use it for all my development now. Issues on GitLab/GitHub are the single source of truth, and three things compound to save around 70% on tokens: model tiering (Haiku for typos, Opus for architecture), session reuse across tasks, and token-free scheduling that burns zero LLM calls for orchestration. Please try it and give some feedback. Also keen to hear from anyone running autonomous coding agents, especially what…
Feb 2026 · github.com
- 21CA
TL;DR: we built a framework-agnostic agent runtime that uses gVisor for isolation and runs on k8s. It’s open-source under AGPLv3 Recently we’ve been working on a customer support “AI assistant” - essentially an interactive knowledge base/L1 support but with an option to touch resources that belong to a customer it’s talking to. We found existing tools to be lacking in these aspects: 1. Fully intercepted i/o. We wanted to trace out LLM calls as well as any other networking calls attempted by the harness so that guardrails and audit trails apply to all current and future systems…
Jul 2026 · github.com
- 22
Ranked by how close each launch is in meaning, then by votes. Refine with a description →