Dev tools · alternatives · 2026

24 alternatives to Dastardly

A lightweight web app security scanner for your CI pipelines

Dastardly is a free web application security scanner designed for CI/CD pipelines. It performs external security scans on web applications to identify vulnerabilities from an attacker's perspective. The tool integrates… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Dastardly launched in 2022; newer entries below may have overtaken it.

1. 1
   Dependency CI – Continuous testing for your dependencies▲198

   SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.

   2016 · dependencyci.com · its alternatives →

2. 2
   Heyhack Scan▲271

   SaaS pen-testing that surpasses the level of ethical hackers

   2022 · auth.heyhack.com · its alternatives →

3. 3IB
   I built ContainerCVE – a web tool to scan public Docker images▲91

   I found it odd there wasn’t a simple web tool to scan Docker Hub images for vulnerabilities. So I built one. It’s powered by the popular open-source tool Trivy.

   2023 · containercve.com · its alternatives →

4. 4AV
   Automatic VPN Generator – Protect Yourself at Sochi and Starbucks▲125

   Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.

   2014 · tinfoilsecurity.com · its alternatives →

5. 5BO
   Bearer – Open-source code security scanning solution (SAST)▲106

   Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…

   2023 · its alternatives →

6. 6
   GenPT▲60

   One-click AI-native security testing for web apps

   Jan 2026 · siemba.io · its alternatives →

7. 7
   Osint tool that finds exposed files on domains▲58

   hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…

   Jul 2026 · search.cerast-intelligence.com · its alternatives →

8. 8
   Smart Scan – REST API, Dashboard, and CI/CD Tools for MCP Security▲15

   Smart Scan Web Application - A sub-app of MCP Shark

   Nov 2025 · smart.mcpshark.sh · its alternatives →

9. 9
   Supaleak▲14

   Secret scanning for shipped-too-fast websites

   Jan 2026 · supaleak.com · its alternatives →

10. 10
    I built a PR listener and ruleset to detect malicious code in CI/CD▲13

    I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…

    2025 · github.com · its alternatives →

11. 11
    Tinfoil Security -- Security For Startups. Launching soon▲36

    Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.

    2011 · tinfoilsecurity.com · its alternatives →

12. 12
    I built a free Burp/Caido alternative that needs zero setup▲32

    An API security workbench for web and Android apps. A browser already routed through the proxy, an Android emulator that already trusts the certificate, and one merged API surface you can export. Free and open source.

    23d ago · apiaxess.dev · its alternatives →

13. 13
    Website Threat Scanner▲10

    A web tool to scan websites for common vulnerabilities

    2025 · webscan.dheerajjha.com · its alternatives →

14. 14CF
    Check for web application security issues.▲23

    2012 · webscanservice.com · its alternatives →

15. 15SS
    Simple SSL Scanner▲31

    Expedited Security provides straightforward security services for Heroku, AWS and Google Cloud

    2014 · expeditedssl.com · its alternatives →

16. 16
    Lazy-tool: reducing prompt bloat in MCP-based agent workflows▲23

    local-first MCP discovery runtime for agents — search before invoke, reduce prompt bloat, and route to local MCP tools - mcp-shark/lazy-tool

    Mar 2026 · github.com · its alternatives →

17. 17
    BrowserTotal: A framework for analyzing browser security posture▲28

    Live extension analysis: Point us at a Chrome/Edge/Firefox extension (store URL or CRX). We spin up a safe sandbox and observe it in real time—permissions use, message passing, storage writes, network calls, remote code loading, and UI injections. Package scanning: Paste an npm/package URL or code. We do quick static + dynamic checks: install/postinstall scripts, obfuscation/eval, exfil endpoints, suspicious APIs, and typosquat/reputation signals. AI explainer: An LLM summarizes the behaviors and risk patterns in plain English (why it’s risky, what to verify,…

    2025 · browsertotal.com · its alternatives →

18. 18
    Real-time security risks detection for any website or server▲22

    Online automated vulnerability scanner to secure firewalls, servers, web applications, and apis. Try 14 days for free.

    2020 · hostedscan.com · its alternatives →

19. 19
    Panguard.AI▲20

    Open-source malware scanner and runtime guard for AI agents

    Jul 2026 · panguard.ai · its alternatives →

20. 20
    HoundDog.ai – Ultra-Fast Code Scanner for Data Privacy▲16

    Hi HN, I'm one of the creators of HoundDog.ai (https://github.com/hounddogai/hounddog). We currently handle privacy scanning for Replit's 45M+ creators. We built HoundDog because privacy compliance is usually a choice between manual spreadsheets or reactive runtime scanning. While runtime tools are useful for monitoring, they only catch leaks after the code is live and the data has already moved. They can also miss code paths that aren't actively triggered in production. HoundDog traces sensitive data in code during development and helps catch risky flows (e.g., PII…

    Feb 2026 · github.com · its alternatives →

21. 21
    SecuriScan▲9

    Scan any website for security flaws in one click

    Nov 2025 · chromewebstore.google.com · its alternatives →

22. 22
    AI Safe Scan▲6

    Complete security scanner web app

    2025 · aisafescan.com · its alternatives →

23. 23
    Shieldome▲6

    Find web vulnerabilities before hackers do.

    Jul 2026 · shieldome.com · its alternatives →

24. 24
    OpenHack – OSS security scanner, 40x cheaper, on par with Opus 4.6▲12

    Open Source Agentic Security Scanner. Contribute to openhackai/OpenHack development by creating an account on GitHub.

    Jun 2026 · github.com · its alternatives →

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →