Dev tools · alternatives · 2026
24 alternatives to Dependency CI – Continuous testing for your dependencies
SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
Dependency CI is a code security analysis tool that scans over 40 programming languages for vulnerabilities, including those in open source dependencies and generated code. It provides static application security… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Dependency CI – Continuous testing for your dependencies launched in 2016; newer entries below may have overtaken it.
- 1BO
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
2023 · its alternatives →
- 2
Fast, portable and reliable dependency analysis for any codebase. Supports license & vulnerability scanning for large monoliths. Language-agnostic; integrates with 20+ build systems. - fossas/fossa-cli
2018 · github.com · its alternatives →
- 3
Dastardly▲57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
- 4
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 5
Free, anonymous dependency & code security scanning
Aug 2026 · depwarden.in · its alternatives →
- 6
Explore the architecture of apps with an interactive graph
2021 · its alternatives →
- 7AV
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.
2014 · tinfoilsecurity.com · its alternatives →
- 8
Trace-AI▲146Know What You Ship. Secure What You Depend On.
Oct 2025 · trace-ai.dev · its alternatives →
- 9
EOL Dataset▲64Find every EOL dependency in your stack. Free. In 5 minutes.
Apr 2026 · herodevs.com · its alternatives →
- 10
Hi, this is Mish and Sebastian. We are working on Step CI - a fully automated API testing platform for developers. Step CI works programming-language independent and for different API paradigms (REST, GraphQL, XML). Our CLI and test runner are available on GitHub (https://github.com/stepci) under the MPLv2 license. Since our last launch, Step CI is now able to generate automated tests for your API based on your OpenAPI (Swagger) spec. This saves you a lot of time as you never have to write and maintain your tests again! We would like to invite you to try our tool and give us…
2022 · stepci.com · its alternatives →
- 11SD
As software engineers we are often confronted with the decision of whether to code something ourselves or to add an existing library that does it for us. Whether we like it or not – we are adding dependencies sooner or later. And it's arguably good practice to check a new dependency beforehand: Is it maintained? By whom? How many issues does it have and how many of those are bugs? Are they being fixed? What's on the roadmap? What's the release frequency and how often do APIs break? One of our favorite solutions that already exist to answer such questions is the OpenSSF Scorecard project…
2025 · shouldiuse.dev · its alternatives →
- 12
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 13
CodeThreat▲104AI that spots real risks and keeps your code safe.
2023 · codethreat.com · its alternatives →
- 14
Monitor NuGet and NPM packages in your repositories
2021 · its alternatives →
- 15
Hello all, Very excited to share this project with you all! Panoptisch scans your Python file or module to find it's imports (aka dependencies) and recursively does so for all dependencies and sub-dependencies. It then generates a dependency tree in JSON for you to parse and enforce import policies. Supply chain attacks are no joke, and this is one way to transparently analyze your dependencies to see if any malicious imports are taking place. For example, your yaml parser, nor it's sub-dependencies should import socket, or sys. Panoptisch is in early stages, with known limitations (for…
2022 · github.com · its alternatives →
- 16
I finally got tired of XKCD #2347 living rent-free in my head, so I built Stacktower: a tool that takes any real package’s dependency graph and turns it into an actual tower of bricks. Along the way I had to wrestle some surprisingly spicy problems. Full blog post here: https://stacktower.io The result is half visualization tool, half love letter to the chaos of modern dependency trees. Open-source, works with PyPI, Cargo, npm, and more. Code: https://github.com/matzehuels/stacktower
Dec 2025 · stacktower.io · its alternatives →
- 17
Hi hackers! I'm a self-taught solo teenage dev working on Seastar, a unified build system and dependency manager for C and C++. It is capable of compiling and linking projects, managing recursive dependencies and headers, and even has a template system -- your C++ library is one `seastar new mylib --lang c++ --lib` away! Also, everything is configured in TOML, because TOML is awesome. C is one of my favorite languages, but I usually end up writing stuff in Rust because I love Cargo. Unlike C, Cargo handles the dependencies, linking, globbing, and so much more for you. So I wrote Seastar to…
2025 · github.com · its alternatives →
- 18
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
- 19
Onboard-CLI—a blazing-fast developer tool I built in Go. It uses AST parsing (Tree-sitter) to map out codebase architecture and automatically blocks spaghetti code and bad dependencies locally before you even commit. I heavily optimized the concurrency, so it can parse 50k+ files in under 10 seconds.
Jul 2026 · github.com · its alternatives →
- 20
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.
2011 · tinfoilsecurity.com · its alternatives →
- 21SI
Identify and remediate code security and privacy risks in your DevSecOps workflows.
2018 · bearer.sh · its alternatives →
- 22TD
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
2023 · trustypkg.dev · its alternatives →
- 23
A fast, dependency-free traceroute implementation in pure C. - davidesantangelo/fastrace
Oct 2025 · github.com · its alternatives →
- 24
Deptools▲9Scan. Score. Decide. One platform for every dependency
Jun 2026 · deptools.io · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →