Alternatives
Products that do what I built a tool for policy driven vetting of open source packages does
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
- 1OA
2016 · oswatch.net
- 2BO
Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management. Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming. Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes. I'd love feedback on the architecture, policy model, and whether this is something you'd consider for…
Aug 2026 · getbor.dev
- 3
- 4
- 5SA
2014 · github.com
- 6IB
I work on R00M 101, a Reddit-based OSINT profiler. While building it, I realized most open-source intelligence (OSINT) tools are scattered across GitHub, outdated blog posts, or random Discords. So I put together a public-facing directory of 100+ OSINT tools used by analysts, journalists, and security folks, free, filterable, and categorized by risk, platform, and use case. The idea was to make something useful and no-friction. Built with static HTML + SQL backend + a lot of caffeine. Would love feedback on how to improve the UX or tool curation. If anyone wants to contribute tools or help…
2025 · r00m101.com
- 7OS
Hi HN, I made OSS Sustain Guard. After every high-profile OSS incident, I wonder about the packages I rely on right now. I can skim issues/PRs and activity on GitHub, but that doesn’t scale when you have tens or hundreds of dependencies. I built this to surface sustainability signals (maintainer redundancy, activity trends, funding links, etc.) and create awareness. It’s meant to start a respectful conversation, not to judge projects. These are signals, not truth; everything is inferred from public data (internal mirrors/private work won’t show up). Quick start: pip install…
Jan 2026 · onukura.github.io
- 8NN
2015 · nixar.work
- 9AS
2014 · github.com
- 10OO
2020 · osohq.com
- 11
- 12AC
I built this toolkit with my colleague to dive deep into OS internals and automate the identification of privilege escalation vectors. Written in pure C without external dependencies, it explores everything from Linux capabilities and Docker escapes to Windows token manipulation and service permissions. We believe that the constant struggle between breaking and securing systems is the ultimate driver of software evolution. This tool is our contribution to that cycle, designed for researchers who want to understand how low-level misconfigurations can be discovered and audited across different…
Jan 2026
- 13DA
2019 · michael.stapelberg.ch
- 14IG
Hey HN, For years, my local development setup has been a fragile mess of tools that never quite played nicely together. On my mac, it was a constant battle with Homebrew services starting (or not starting) on boot, conflicting PHP and Node versions managed by `asdf` or `nvm`, and a collection of `docker-compose.yml` files that I'd copy-paste and tweak for every single project. The cognitive load was just too high. Setting up SSL was another chore involving `mkcert`. Sharing a quick demo with a colleague meant firing up ngrok. And if I wanted to run two projects that needed different versions…
Oct 2025 · servbay.com
- 15OD
2021 · osv.dev
- 16VN
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com
- 17SZ
We're launching SecureBuild: https://securebuild.com — a new way for open source projects and maintainers to earn revenue by partnering with and endorsing our Zero-CVE container images of their project. We’ve spent the last decade at Replicated (https://news.ycombinator.com/item?id=9841243) helping commercial and open source software vendors securely distribute their apps to enterprise environments. During that time, we saw firsthand how hard it is for maintainers to fund their work, and how increasingly demanding enterprises have become when it comes to demonstrable…
2025 · securebuild.com
- 18ET
2018 · youtube.com
- 19CL
Hey people! I have been compiling a database of opensource alternatives and I'm super proud of it so far. It serves as a searchable directory for high-quality opensource. After tons of hours I've managed to compile a database of 1000+ opensource software. I've seen other sites which have the same premise and all the GitHub Awesome Lists, but they lack in showing if the repo is active, abandoned, experimental, buggy/unstable, has a restrictive license or corporate influence like this does. Thanks for your time, if you have any recommendations for features/additions I'd love to hear.
Feb 2026 · opensrc.me
- 20IB
2024 · securelog.com
- 21AE
2023 · github.com
- 22IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 23TD
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
2023 · trustypkg.dev
- 24SD
As software engineers we are often confronted with the decision of whether to code something ourselves or to add an existing library that does it for us. Whether we like it or not – we are adding dependencies sooner or later. And it's arguably good practice to check a new dependency beforehand: Is it maintained? By whom? How many issues does it have and how many of those are bugs? Are they being fixed? What's on the roadmap? What's the release frequency and how often do APIs break? One of our favorite solutions that already exist to answer such questions is the OpenSSF Scorecard project…
2025 · shouldiuse.dev
Ranked by how close each launch is in meaning, then by votes. Refine with a description →