Dev tools · alternatives · 2026
24 alternatives to DepWarden
Free, anonymous dependency & code security scanning
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
2016 · dependencyci.com · its alternatives →
- 2BO
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
2023 · its alternatives →
- 3
dif.sh▲373Markdown feature flags your coding agent installs for you
Aug 2026 · dif.sh · its alternatives →
- 4
Hi HN! I'm Gabriel, the author of dep-tree (https://github.com/gabotechs/dep-tree), and I wanted to show off this tool and explain why it's being really useful at my current org for dealing with code complexity. I work at a startup where business evolves really fast, and requirements change frequently, so it's easy to end up with big piles of code stacked together without a clear structure, specially with tight deadlines. I made dep-tree [1] to help us maintain a clean code architecture and a logical separation of concerns between parts of the application, which is…
2024 · github.com · its alternatives →
- 5
A syntax-highlighting pager for git, diff, grep, rg --json, and blame output - dandavison/delta
2020 · github.com · its alternatives →
- 6
EOL Dataset▲64Find every EOL dependency in your stack. Free. In 5 minutes.
Apr 2026 · herodevs.com · its alternatives →
- 7
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com · its alternatives →
- 8
- 9
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 10
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2019 · packagr.app · its alternatives →
- 11
hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…
Jul 2026 · search.cerast-intelligence.com · its alternatives →
- 12
Rev-dep is a dependency analysis and optimization CLI for JavaScript and TypeScript projects. It helps answer questions like: where is this file used, what are the entry points, are there circular dependencies, and which files or node_modules are unused. I recently rewrote it from scratch in Go to focus on performance and low memory usage. On large codebases (500k+ LOC), circular dependency detection runs in a few hundred milliseconds and is up to 175x faster than Madge in my benchmarks. Feature-wise it overlaps partially with tools like madge, dpdm, skott, and dependency-cruiser, but aims…
Feb 2026 · github.com · its alternatives →
- 13
FOSSA secures the software supply chain with automated SBOM generation, software composition analysis, license compliance, and vulnerability management.
2017 · fossa.io · its alternatives →
- 14
I finally got tired of XKCD #2347 living rent-free in my head, so I built Stacktower: a tool that takes any real package’s dependency graph and turns it into an actual tower of bricks. Along the way I had to wrestle some surprisingly spicy problems. Full blog post here: https://stacktower.io The result is half visualization tool, half love letter to the chaos of modern dependency trees. Open-source, works with PyPI, Cargo, npm, and more. Code: https://github.com/matzehuels/stacktower
Dec 2025 · stacktower.io · its alternatives →
- 15
- 16
Online automated vulnerability scanner to secure firewalls, servers, web applications, and apis. Try 14 days for free.
2020 · hostedscan.com · its alternatives →
- 17TS
Hi HN, I’m Guillaume, the cofounder of Bearer, an Open Source SAST solution. After launching a few weeks ago here on Hacker News with support for Ruby and JavaScript stacks, I’m happy to report we’ve just released a new version (v1.2) with TypeScript support! In terms of code coverage, we use the same rules already implemented for vanilla JavaScript, but as usual, you can build your own. The rules list is here: https://docs.bearer.com/reference/rules/ It’s a first version for TS, but we believe that thanks to the pre-existing JavaScript support it should already…
2023 · its alternatives →
- 18
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com · its alternatives →
- 19
- 20SI
Identify and remediate code security and privacy risks in your DevSecOps workflows.
2018 · bearer.sh · its alternatives →
- 21OV
2017 · tool.smartdec.net · its alternatives →
- 22
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
- 23
We're open-sourcing Sighthound today, our rules-based static security scanner. What makes it special is that it's coded in rust and uses tree-sitter as it's AST making it very fast and easily extensible. Why build another scanner in 2026? We wanted to improve some of our detection outcomes but noticed the current open source scanners like Semgrep/Opengrep we're capped by a bunch of adoption limitations such as being written in OCaml, requiring a lot of work to add a language parser, and the rulesets were licensed differently and required paid offerings. It also felt that licensing was…
Jul 2026 · github.com · its alternatives →
- 24BG
We originally set out to solve complex debugging headaches and useless alerts caused by traditional security scanners in our own projects. Static Analysis (SAST) flagged too much noise because it couldn't verify runtime context, while Dynamic Analysis (DAST) missed internal logic bugs because it treated the app like a black box. We built a CLI tool to bridge this gap using grey box testing from a red team approach. We use internal knowledge of the codebase to guide parallel execution, allowing us to find complex or hidden logic errors and attack paths standard linters/scanners miss. The…
Dec 2025 · bloodhoundsecurity.ca · its alternatives →
Also compare
- Dependency CI – Continuous testing for your dependencies alternatives
- Bearer – Open-source code security scanning solution (SAST) alternatives
- dif.sh alternatives
- Visualize the entropy of a codebase with a 3D force-directed graph alternatives
- A syntax highlighter for Git and diff output, written in Rust alternatives
- EOL Dataset alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →