Dev tools · alternatives · 2026

24 alternatives to pompelmi

Hi HN — I’m the author of pompelmi, an open-source, in-process scanner for untrusted file uploads in Node.js. Motivation: I wanted a practical “upload guard” that reduces common upload risks (ZIP bombs, traversal in archives, MIME spoofing, polyglots/macro hints) without sending files to a cloud AV service (privacy + latency + GDPR concerns). Key points: - Runs in-process (no cloud calls); files never leave your infrastructure - Deep ZIP inspection with configurable limits (depth/entries/ratio) + nested archive scanning - Composable scanners (heuristics + optional signature…

Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.

1
Pompelmi▲1
In-process file upload security for Node.js
Mar 2026 · pompelmi.app · its alternatives →
2
errsole▲133
First open-source Node.js logger with a built-in log viewer
2025 · github.com · its alternatives →
3
I wrote a new BitTorrent tracker in Elixir▲394
Hello everyone! I'm currently in a journey to learn and improve my Elixir and Go skills (my daily job uses C++) and looking through my backlog for projects to take on I decided Elixir is the perfect language to write a highly-parallel BitTorrent tracker. So I have spent my free time these last 3 months writing one! Now I think it has enough features to present it to the world (and a docker image to give it a quick try). I know some people see trackers as relics of the past now that DHT and PEX are common but I think they still serve a purpose in today's Internet (purely talking about public…
2025 · github.com · its alternatives →
4
Fast, native Mac file manager (filters, fuzzy find, 9 MB, no Electron)▲98
My Downloads folder had been left unkept for a really long time and cleaning it up using Finder was quite cumbersome. So I started creating a simple app to help me filter out and delete or move the files in the folder. It started out very basic and the filtering options genuinely helped me clean out the Downloads folder, then as I thought of more features I would like to see in a file manager I started to add them. Some of the features are: - Fuzzy go to folder/file where you only need to write a few letters of a full path, get suggestions and can jump to the correct path instantly -…
Jul 2026 · whimfiles.com · its alternatives →
5
I just open sourced Muxamp, a streaming media playlist in Node.js▲32
Hey HN! I've been working on Muxamp for over a year now, and I decided that there's no point in keeping the source closed. (I never planned on making money from it.) I've learned a lot since I started, and I hope others can benefit from its release--and perhaps teach me a thing or two as well :)
2013 · github.com · its alternatives →
6
Playback – Interactive Programming and Print Debugging Reimagined▲14
Ladies and gentlemen of a Lisp persuasion, Clojurians and Clojuristas, followers of the paren and everyone else covetously eyeing the greener grass, I made an open-source thing that I would like to share with you. My elevator pitch is that it'll make you forget all about regular print debugging in 10 minutes straight. The slightly longer pitch is this: #>(tag'n'trace any Clojure(-Script) form to `tap>` and Portal with automatic last-input function replay on eval, instant re-render and hassle-free insertion of traced data into the REPL) And before I end up pasting half the README here in bits…
2023 · github.com · its alternatives →
7
ProKZee – An Open-Source Network Security Tool Written in Go▲7
Hi HN! After several months of work, I'm excited to share ProKZee, a free and open-source network security tool built with Go and React using Wails framework. ProKZee allows developers, security researchers, and penetration testers to intercept, inspect, and modify HTTP/S traffic — similar to tools like Burp Suite, OWASP ZAP, and Caido — but with a fast native UI, modern UX, and some unique features. https://github.com/al-sultani/prokzee
2025 · github.com · its alternatives →
8AM
A minimal TS library that generates prompt injection attacks▲33
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io · its alternatives →
9
nukon-pi-detect▲4
Tiny, offline prompt-injection scanner for CI pipelines
Apr 2026 · github.com · its alternatives →
10FM
Filelove – minimal P2P file transfer right in the browser▲9
2022 · file.love · its alternatives →
11MS
Minimalistic secure open source paste bin service▲9
2016 · bin.so · its alternatives →
12
HoundDog.ai – Ultra-Fast Code Scanner for Data Privacy▲16
Hi HN, I'm one of the creators of HoundDog.ai (https://github.com/hounddogai/hounddog). We currently handle privacy scanning for Replit's 45M+ creators. We built HoundDog because privacy compliance is usually a choice between manual spreadsheets or reactive runtime scanning. While runtime tools are useful for monitoring, they only catch leaks after the code is live and the data has already moved. They can also miss code paths that aren't actively triggered in production. HoundDog traces sensitive data in code during development and helps catch risky flows (e.g., PII…
Feb 2026 · github.com · its alternatives →
13
I built a PR listener and ruleset to detect malicious code in CI/CD▲13
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
14
I made an open-source Replit▲9
I spent the past few weeks making an open source cloud code editing environment with an AI copilot and multiplayer collaboration! It's fully self-hostable in 5-10 minutes. There's a lot of minor improvements to be made, and some are already listed in the Github issues. Let me know what you think and feel free to try it out.
2024 · github.com · its alternatives →
15
Open-lmake, a scalable, reliable build system with auto dep-tracking▲6
Hello Hacker News, I often hear people saying "all build-systems suck", an opinion I have been sharing for years, and this is the motivation for this project. I finally got the opportunity to make it open-source, and here it is. In a few words, it is like make, except it can be comfortably used even in big projects using HPC (with millions of jobs, thousands of them running in parallel). The major differences are that: - dependencies are automatically tracked (no need to call gcc -M and the like, no need to be tailored to any specific tool, it just works) by spying disk activity - it is…
2025 · github.com · its alternatives →
16
AttackerView▲13
Last week I wrote about building a scanner that writes its own exploits. A cron job runs Claude Code every night, it reads new CVEs, writes proof-of-concept checks, tests them against vulnerable and patched Docker instances, and opens PRs. I review and merge in the morning. That post was about how t
Feb 2026 · attackerview.com · its alternatives →
17
PwnScan▲8
For at least a few years (since before COVID), in my circle everbody wants an AI tool that finds vulnerabilities in binaries. I have my reservations about such a tool because of my perception that AI is overhyped, so I decided to build one myself to see how useful it could be (or not). I was actually kinda surprised how well it worked for my collection of binaries with known CVEs. It definitely has false positives and negatives, as any static analysis tool would, but I think its actually somewhat usable. I dont think the results are super actionable, but interesting nonetheless. I still…
2025 · pwnscan.com · its alternatives →
18
GO // SCAN — Instant PDF Scanner▲4
Built it for myself. Scans to PDF. Stores nothing.
Jun 2026 · mdarych.github.io · its alternatives →
19KI
Kekkai – Interactive security triage in the terminal▲6
Hey HN, As an AppSec engineer, I’ve spent a lot of time running and tunning open-source security scanners like Trivy, Semgrep, Gitleaks and Dojo. What I have found is that running them is easy, reviewing the results, not so much. Each tool outputs different JSON, false positives pile up, and CI either becomes noisy or blocks everything. So I built Kekkai (formerly Hokage), a small open-source CLI that wraps these scanners and focuses specifically on human triage. Kekkai runs the scanners in isolated Docker containers, normalizes their outputs into a single format, and provides an interactive…
Feb 2026 · its alternatives →
20
ttl.sh – Anonymous, ephemeral (& free) Docker image registry▲9
Free, anonymous, and ephemeral OCI registry. No sign-up required. Push your images and they expire automatically.
2019 · ttl.sh · its alternatives →
21
I built a tool for policy driven vetting of open source packages▲7
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com · its alternatives →
22UF
Unzip from 500MB remote archive in 400ms or less▲10
2017 · npmjs.com · its alternatives →
23
Hagana – Runtime protection for Node.js to block supply chain attacks▲11
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com · its alternatives →
24
CR4SH3R – Fast WordPress Plugin Vulnerability Scanner▲5
A few months ago, a friend asked me to check his WordPress site for vulnerabilities. What I found shocked me – critical flaws exposing sensitive data everywhere. That's why I built CR4SH3R: a focused tool to detect Arbitrary File Download flaws before attackers do Key Features: Lightning-fast multi-threaded scanning, Extracts credentials from exposed files (like wp-config.php), Generates actionable Excel reports, Simple GUI for one-click security checks Would love your feedback!
2025 · github.com · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →