Dev tools · alternatives · 2026
24 alternatives to Cerbos. Open source, horizontally scalable, stateless authorization
Cerbos PDP, policy decision point, is an open source authorization layer that can evolve as your product grows. It enables developers to define powerful, context-aware access control in simple, intuitive, and testable policies. Cerbos runs in your own environment. We started working on Cerbos[0] over 3 years ago. Permission management across applications is difficult, especially as the code base grows: you have hundreds of users, many services in different languages, and several environments. Hardcoded access control rules tangled with business logic make every new role and permission change…
Cerbos is an open source authorization layer that works as a policy decision point for access control across applications. Developers use it to define context-aware permission rules in simple, testable policies rather… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Cerbos. Open source, horizontally scalable, stateless authorization launched in 2024; newer entries below may have overtaken it.
- 1CH
Hello HN! I'm on the DevRel team at Cerbos (https://cerbos.dev/), a tool designed to manage who can do what in your software applications. For a couple of years now, Open Worldwide Application Security Project (OWASP) is naming authorization a top 10 API security risk: https://owasp.org/API-Security/editions/2023/en/0x11-t10/ We are thrilled to announce that Cerbos Hub is now in public beta! Join the beta and help us shape the future of authZ: https://hub.cerbos.cloud/ Cerbos Hub is a managed service offering for the open…
2023 · its alternatives →
- 2
- 3
Permit.io▲677The new Permit.io CLI brings developer-first workflows to access control. Define, test, deploy, and enforce fine-grained authorization using AI, CI/CD, GitOps, and OpenAPI — all from your terminal
2023 · permit.io · its alternatives →
- 4
Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management. Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming. Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes. I'd love feedback on the architecture, policy model, and whether this is something you'd consider for…
Aug 2026 · getbor.dev · its alternatives →
- 5
A SDK for access control policies: authorization for the microservice and IoT age. Inspired by AWS IAM policies. Written for Go. - ory/ladon
2017 · github.com · its alternatives →
- 6OO
Oso helps companies run agents in production with confidence using monitoring, access controls, and automated least privilege.
2020 · osohq.com · its alternatives →
- 7
Cloud-native authorization for modern applications and APIs - aserto-dev/topaz
2022 · github.com · its alternatives →
- 8
Permify was born out of our repeated struggles with authorization. Like any other piece of software, authorization starts small but as things grow scaling it becomes a real pain and begins to hinder product development processes. Ad-hoc authorization systems scattered throughout your app’s codebase are hard to manage, reason about, and iterate on as the company grows. Also you will need to have more specific access controls as things grow. Traditional approaches like RBAC is inefficient for defining granular permissions such as resource-specific, hierarchical, or context-aware permissions.…
2024 · github.com · its alternatives →
- 9
Credentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.
2022 · github.com · its alternatives →
- 10
- 11
Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee
May 2026 · github.com · its alternatives →
- 12
Cead Consent▲82Simple, lightweight and easy cookie/tracking consent manager
2021 · github.com · its alternatives →
- 13
SSH-based "VPN for poors". Contribute to ivanilves/xiringuito development by creating an account on GitHub.
2017 · github.com · its alternatives →
- 14
- 15
We’ve been building visual rule engines (clear spreadsheet interfaces -> API endpoints that map incoming data to a large number of potential outcomes), and had the fun idea lately to see what happens when we use our decision table UI with Claude’s PreToolUse hook. The result is a surprisingly useful policy/gating layer– these tables let your team: - Write conditional, exception-friendly policies beyond globs/prefixes (e.g. allow rm -rf only in */node_modules/*, deny / or $HOME, ask if --force or network call; gate kubectl delete / SQL DROP with a clear reason) -…
Jan 2026 · github.com · its alternatives →
- 16EA
Having been regularly annoyed by Proton and even Gmail search on emails, especially after working every day with coding agents in the past year or so, I wanted to catch up the experience of searching emails to the rest of the world. Not a big innovation, but a real itch scratcher as far as I'm concerned.
Jun 2026 · margaine.com · its alternatives →
- 17
Hey everyone, I previously introduced an open source private home security camera in 2024, which uses OpenMLS for end-to-end encryption: https://news.ycombinator.com/item?id=42284412. It was called Privastead then and it's now renamed to Secluso. John Kaczman found my project from here and has been working on it with me over the last year and half. We've made a lot of improvements to the software, which we would like to share with you: - You can now set this up on your Raspberry Pi in less than 5 minutes with no technical expertise using our easy-to-use GUI deploy tool. We've…
May 2026 · github.com · its alternatives →
- 18
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 19
- 20WA
Keep your server access safe, share it wisely & control the work performed on server. Powerful server audit tool with log records and screen casting of each server session.
2020 · werbot.com · its alternatives →
- 21
Hello HN, Introducing Pezzo – a developer-centric LLMOps platform designed to streamline Generative AI integrations. As Generative AI gains traction, we've observed a gap in tools catering to product teams and developers. Most are oriented toward ML/AI experts. That's why we created Pezzo - fully open-source under Apache 2.0. GitHub: https://github.com/pezzolabs/pezzo Why Pezzo? - Centralized Prompt Management: Think email templates but for prompts. Design, test, and publish prompts without undergoing an extensive release cycle. - Observability & Insights:…
2023 · github.com · its alternatives →
- 22
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Dec 2025 · github.com · its alternatives →
- 23KO
2018 · klaro.kiprotect.com · its alternatives →
- 24
eBPF-based Linux kernel guard that lets only allowlisted binaries use the TPM. - bschaatsbergen/tpmlsm
18d ago · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →