Dev tools · alternatives · 2026
24 alternatives to SafeDep Vet
GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
SafeDep Vet is a GitLab CI component that scans open source dependencies for vulnerabilities and malicious packages within your pipeline. It integrates directly into GitLab CI workflows and lets teams define custom… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. SafeDep Vet launched in 2023; newer entries below may have overtaken it.
- 1
The intelligent orchestration platform for DevSecOps, enabling teams and agents to ship trusted software at enterprise scale.
2012 · gitlab.io · its alternatives →
- 2
SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
2016 · dependencyci.com · its alternatives →
- 3
- 4
Koidex▲380Know if a package, extension, or AI model is actually safe
Feb 2026 · dex.koi.security · its alternatives →
- 5
vet — A safer way to run remote scripts.
2025 · getvet.sh · its alternatives →
- 6
Open safety reasoning models with custom safety policies
Oct 2025 · openai.com · its alternatives →
- 7
- 8
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code
Dec 2025 · github.com · its alternatives →
- 9
Gammacode▲269Web and Terminal agents that scan, fix, and ship secure code
Oct 2025 · its alternatives →
- 10
- 11
🦊 Test your Gitlab CI Pipelines changes locally using Docker. - mdubourg001/glci
2021 · github.com · its alternatives →
- 12
Vet▲120Vet is a fast and local code review tool open-sourced by the Imbue team. It’s concise where others are verbose.
Mar 2026 · imbue.com · its alternatives →
- 13
aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.
2015 · appcanary.com · its alternatives →
- 14
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
- 15
GitHub▲13Prevent merging of malicious code in pull requests and CI/CD
2025 · github.com · its alternatives →
- 16
A curated database of insecure Python packages. Contribute to pyupio/safety-db development by creating an account on GitHub.
2016 · github.com · its alternatives →
- 17
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com · its alternatives →
- 18
Hey, we built an open-source CLI in Go purposed to help you answer security questions across your cloud, code and runtime. It connects to your GitHub, GitLab, AWS, GCP, Azure & K8s using the credentials that are already in your shell, while limiting itself to read-only. The core innovation here is the trust boundary - our agent has a built-in code execution sandbox with no host or network access; it is exposed to an internal tool which we call an “action gate” that performs read-only HTTP requests to your own infrastructure. Since the cloud providers constantly expand actions and services,…
Jul 2026 · github.com · its alternatives →
- 19
Runtime security solution for CI/CD pipelines
2023 · cycode.com · its alternatives →
- 20
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev · its alternatives →
- 21
- 22SkillShield▲73
Security-scored directory for AI skills and agent tools
Feb 2026 · skillshield.io · its alternatives →
- 23
Hello HN, my name is Varun, and I am the co-founder of StepSecurity. Here is the backstory about Harden-Runner. We thoroughly researched past software supply chain security incidents. The devastating breaches of SolarWinds, Codecov, and others, have one thing in common – they attacked the CI/ CD pipeline or the build server. These incidents made it clear that a purpose-built security agent was needed for CI/ CD. While there are numerous agents available for desktops and servers, such as from CrowdStrike and Lacework, none have been tailored specifically to address the unique risks…
2023 · github.com · its alternatives →
- 24
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →