Dev tools · alternatives · 2026
24 alternatives to I built a tool for policy driven vetting of open source packages
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. I built a tool for policy driven vetting of open source packages launched in 2023; newer entries below may have overtaken it.
- 1
Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management. Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming. Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes. I'd love feedback on the architecture, policy model, and whether this is something you'd consider for…
Aug 2026 · getbor.dev · its alternatives →
- 2
- 3
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 4
Open safety reasoning models with custom safety policies
Oct 2025 · openai.com · its alternatives →
- 5
2014 · github.com · its alternatives →
- 6
A curated database of insecure Python packages. Contribute to pyupio/safety-db development by creating an account on GitHub.
2016 · github.com · its alternatives →
- 7
I work on R00M 101, a Reddit-based OSINT profiler. While building it, I realized most open-source intelligence (OSINT) tools are scattered across GitHub, outdated blog posts, or random Discords. So I put together a public-facing directory of 100+ OSINT tools used by analysts, journalists, and security folks, free, filterable, and categorized by risk, platform, and use case. The idea was to make something useful and no-friction. Built with static HTML + SQL backend + a lot of caffeine. Would love feedback on how to improve the UX or tool curation. If anyone wants to contribute tools or help…
2025 · r00m101.com · its alternatives →
- 8
Hi HN, I made OSS Sustain Guard. After every high-profile OSS incident, I wonder about the packages I rely on right now. I can skim issues/PRs and activity on GitHub, but that doesn’t scale when you have tens or hundreds of dependencies. I built this to surface sustainability signals (maintainer redundancy, activity trends, funding links, etc.) and create awareness. It’s meant to start a respectful conversation, not to judge projects. These are signals, not truth; everything is inferred from public data (internal mirrors/private work won’t show up). Quick start: pip install…
Jan 2026 · onukura.github.io · its alternatives →
- 9
and the open source Codes of Conduct
2016 · gadgetsprimer.com · its alternatives →
- 10
- 11AC
I built this toolkit with my colleague to dive deep into OS internals and automate the identification of privilege escalation vectors. Written in pure C without external dependencies, it explores everything from Linux capabilities and Docker escapes to Windows token manipulation and service permissions. We believe that the constant struggle between breaking and securing systems is the ultimate driver of software evolution. This tool is our contribution to that cycle, designed for researchers who want to understand how low-level misconfigurations can be discovered and audited across different…
Jan 2026 · its alternatives →
- 12
PACE▲88The new OS data security engine, write data policies as code
2024 · github.com · its alternatives →
- 13
Developers want $$ but everyone else wants free software...
2016 · heavybit.com · its alternatives →
- 14
LegacyFixer▲61Python dependency security scans with optional fix PRs
13d ago · legacyfixer.ai · its alternatives →
- 15
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com · its alternatives →
- 16SZ
We're launching SecureBuild: https://securebuild.com — a new way for open source projects and maintainers to earn revenue by partnering with and endorsing our Zero-CVE container images of their project. We’ve spent the last decade at Replicated (https://news.ycombinator.com/item?id=9841243) helping commercial and open source software vendors securely distribute their apps to enterprise environments. During that time, we saw firsthand how hard it is for maintainers to fund their work, and how increasingly demanding enterprises have become when it comes to demonstrable…
2025 · securebuild.com · its alternatives →
- 17
disclose.io▲11Driving safety & standardization in vulnerability disclosure
2018 · disclose.io · its alternatives →
- 18
I'm the head of product at ROOST, a nonprofit focused on democratizing online safety technology through open source software, and one of the people behind Osprey, an open-source rules engine for fighting abuse at scale. We just released v1.0, which is what's running in production at Discord and Bluesky (and soon Matrix!), processing hundreds of millions of events daily. Most platforms face a bad choice: build custom abuse-fighting infrastructure from scratch, or use closed vendor solutions. We built Osprey to give smaller platforms and communities access to the same quality of tooling that…
Jun 2026 · roost.tools · its alternatives →
- 19CL
Hey people! I have been compiling a database of opensource alternatives and I'm super proud of it so far. It serves as a searchable directory for high-quality opensource. After tons of hours I've managed to compile a database of 1000+ opensource software. I've seen other sites which have the same premise and all the GitHub Awesome Lists, but they lack in showing if the repo is active, abandoned, experimental, buggy/unstable, has a restrictive license or corporate influence like this does. Thanks for your time, if you have any recommendations for features/additions I'd love to hear.
Feb 2026 · opensrc.me · its alternatives →
- 20
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
- 21
An awesome list of OSS developer-first security tools - boxyhq/awesome-oss-devsec
2022 · github.com · its alternatives →
- 22TD
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
2023 · trustypkg.dev · its alternatives →
- 23
AttackerView▲13Last week I wrote about building a scanner that writes its own exploits. A cron job runs Claude Code every night, it reads new CVEs, writes proof-of-concept checks, tests them against vulnerable and patched Docker instances, and opens PRs. I review and merge in the morning. That post was about how t
Feb 2026 · attackerview.com · its alternatives →
- 24FF
2021 · spatcher.io · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →