Dev tools · alternatives · 2026
24 alternatives to Bearer – Open-source code security scanning solution (SAST)
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
Bearer is an open-source static application security testing tool that scans codebases to discover, filter, and prioritize security vulnerabilities. It targets security and engineering teams with a distinctive focus on… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Bearer – Open-source code security scanning solution (SAST) launched in 2023; newer entries below may have overtaken it.
- 1
Bearer CLI▲174Free & open source security scanner for developers
2023 · cycode.com · its alternatives →
- 2SI
Identify and remediate code security and privacy risks in your DevSecOps workflows.
2018 · bearer.sh · its alternatives →
- 3
Hello there, I’m Guillaume, the cofounder and CEO of Bearer, a code security startup trying to rethink security products for a developer-first World. 7 months ago we introduced on HN, Bearer CLI (https://github.com/Bearer/bearer), our free and open code security scanner supporting at the time only Ruby and JavaScript applications. We’ve been working very hard with the team, thanks to community feedback to bring tons of new features as well as more language support to become everyone’s go-to code security solution. Just to name a few major features: - Native integration…
2023 · github.com · its alternatives →
- 4TS
Hi HN, I’m Guillaume, the cofounder of Bearer, an Open Source SAST solution. After launching a few weeks ago here on Hacker News with support for Ruby and JavaScript stacks, I’m happy to report we’ve just released a new version (v1.2) with TypeScript support! In terms of code coverage, we use the same rules already implemented for vanilla JavaScript, but as usual, you can build your own. The rules list is here: https://docs.bearer.com/reference/rules/ It’s a first version for TS, but we believe that thanks to the pre-existing JavaScript support it should already…
2023 · its alternatives →
- 5
Bearer Cloud▲115Manage product and application code security at scale
2023 · cycode.com · its alternatives →
- 6
- 7
SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
2016 · dependencyci.com · its alternatives →
- 8
- 9
Develop faster, eliminate complexity, protect your secrets
2022 · 1password.com · its alternatives →
- 10
SSOReady▲144Open source developer tools for enterprise single sign-on
2024 · github.com · its alternatives →
- 11
Hey HN! Happy to finally launch Stack. We made it because we like to put apps into production quickly, and authentication & user management was taking up way too much time. We have components like and that automatically adapt to whatever theme & design system you're using. Check the blog post to see the example with Radix UI and Joy UI. Also, there's an admin dashboard for monitoring and editing accounts. Stack is 100% AGPL/MIT-licensed, so you can self-host it. Cheers!
2024 · stack-auth.com · its alternatives →
- 12
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com · its alternatives →
- 13
hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…
Jul 2026 · search.cerast-intelligence.com · its alternatives →
- 14AV
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.
2014 · tinfoilsecurity.com · its alternatives →
- 15
Open sourced application to detect security vulnerabilities.
2020 · github.com · its alternatives →
- 16
Redential▲116A developer credential that proves what you built, NDA safe.
Jul 2026 · redential.com · its alternatives →
- 17BO
2018 · tech.buzzfeed.com · its alternatives →
- 18
I built this as a small side project to learn and experiment, and I ended up with this! I used a subdomain from my personal portfolio, and everything else runs on free tiers. The project uses Nuxt, SVG, Cloudflare Workers, D1 (SQL), KV, Terraform, and some agentic coding with OpenAI Codex and Claude Code. What started as a joke among friends turned into a fun excuse to build something end to end, from zero to production, and to explore a few things I’d never touched before. I’d really appreciate any feedback or suggestions.
Jan 2026 · certificate.brendonmatos.com · its alternatives →
- 19GO
Hey HN! We’re Jai and Sanket, co-founders of DeepSource (YC W20). We're open-sourcing Globstar (https://github.com/DeepSourceCorp/globstar), a static analysis toolkit that lets you easily write and run custom code quality and security checkers in YAML [1] or Go [2]. After 5+ years of building AST-based static analyzers that process millions of lines of code daily at DeepSource, we kept hearing a common request from customers: "How do we write custom checks specific to our codebase?" AppSec and DevOps teams have a lot of learned anti-patterns and security rules they want…
2025 · its alternatives →
- 20GM
2017 · gitmonkey.io · its alternatives →
- 21
We're open-sourcing Sighthound today, our rules-based static security scanner. What makes it special is that it's coded in rust and uses tree-sitter as it's AST making it very fast and easily extensible. Why build another scanner in 2026? We wanted to improve some of our detection outcomes but noticed the current open source scanners like Semgrep/Opengrep we're capped by a bunch of adoption limitations such as being written in OCaml, requiring a lot of work to add a language parser, and the rulesets were licensed differently and required paid offerings. It also felt that licensing was…
Jul 2026 · github.com · its alternatives →
- 22AR
From the cryptic terminal commands to the innumerable ways to shoot yourself in the foot, I always struggled to use TLS certificates. I love how much easier (and cheaper) Let's Encrypt made it to get certificates, but there are still plenty of things to struggle with. That's why we built Relay: a free, browser-based tool that streamlines the ACME workflow, especially for tricky setups like homelabs. Relay acts as a secure intermediary between your ACME client and public certificate authorities like Let's Encrypt. Some ways Relay provides a better experience: - really fast, streamlined…
2025 · anchor.dev · its alternatives →
- 23
2014 · github.com · its alternatives →
- 24
Dastardly▲57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →