Dev tools · alternatives · 2026
24 alternatives to tfsec
🔒🌍 Static analysis powered security scanner for terraform
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. tfsec launched in 2019; newer entries below may have overtaken it.
- 1
DeepSource for Goâ–˛87Static analysis you'd actually use
2020 · app.deepsource.com · its alternatives →
- 2
tracexec helps you to figure out what and how programs get executed when you execute a command. It's useful for debugging build systems, catching fd leaks, understanding what shell scripts actually do, figuring out what programs does a proprietary software run, etc.
2024 · github.com · its alternatives →
- 3
The CrowdSec Consoleâ–˛193Monitor cyber threats on your online services
2022 · app.crowdsec.net · its alternatives →
- 4
Digger is enterprise-ready, self-hostable infrastructure tooling. Terraform CI/CD, drift detection, PR automation, and state management. Open source DevOps for cloud-native teams.
2021 · diggerdev.com · its alternatives →
- 5BO
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
2023 · its alternatives →
- 6
- 7
- 8IB
I found it odd there wasn’t a simple web tool to scan Docker Hub images for vulnerabilities. So I built one. It’s powered by the popular open-source tool Trivy.
2023 · containercve.com · its alternatives →
- 9
Hi HN, we're Lucas and Lucas, the authors of Layerform (https://github.com/ergomake/layerform). Layerform is an open-source tool for setting up development environments using plain .tf files. We allow each engineer to create their own "staging" environment and reuse infrastructure. Whenever engineers run layerform spawn, we use plain .tf files to give them their own "staging" environment that looks just like production. Many teams have a single (or too few) staging environments, which developers have to queue to use. This is particularly a problem when a system is large,…
2023 · github.com · its alternatives →
- 10
Hi HN! I’m so excited to show my first open-source project and first post here. I initially started this project to learn Go language, it is an experimental project. The main goal is to track the adventure of a WebRTC stream from start to finish, by debugging the project or tracking the output at console. By trying out this project, you will deep dive into the steps which are taken while starting up a WebRTC session, and more. It consists of a web UI (TypeScript) and a server back-end (Golang) projects. They can run on Docker containers, in development mode or production mode, you can find…
2022 · github.com · its alternatives →
- 11
Digger is an open source IaC orchestration tool. Digger allows you to run IaC in your existing CI pipeline ⚡️ - GitHub - diggerhq/digger: Digger is an open source IaC orchestration tool. Digger allows you to run IaC in your existing CI pipeline ⚡️
2023 · github.com · its alternatives →
- 12
CodeSec by Contrastâ–˛119Secure code in less than 5 minutes for free
2022 · contrastsecurity.com · its alternatives →
- 13GO
Hey HN! We’re Jai and Sanket, co-founders of DeepSource (YC W20). We're open-sourcing Globstar (https://github.com/DeepSourceCorp/globstar), a static analysis toolkit that lets you easily write and run custom code quality and security checkers in YAML [1] or Go [2]. After 5+ years of building AST-based static analyzers that process millions of lines of code daily at DeepSource, we kept hearing a common request from customers: "How do we write custom checks specific to our codebase?" AppSec and DevOps teams have a lot of learned anti-patterns and security rules they want…
2025 · its alternatives →
- 14
RustScanâ–˛108Fast and developer-friendly Rust contract security scanner
2025 · its alternatives →
- 15TD
2022 · terragen.dev · its alternatives →
- 16
Hi HN! We’re Ethan and Danny, the authors of Tangent (https://github.com/telophasehq/tangent), a Rust-based log pipeline where all normalization, enrichment, and detection logic runs as WASM plugins. We kept seeing the same problems in the OCSF (https://ocsf.io) community: 1) Schemas change constantly. Large companies have whole teams dedicated to keeping vendor→OCSF mappings up to date. 2) There’s no shared library of mappings, so everyone recreates the same work. 3) Writing mappers is tedious, repetitive work. 4) Most pipelines use proprietary DSLs that are…
Nov 2025 · github.com · its alternatives →
- 17
Automagically generate infrastructure-as-code on AWS
2022 · its alternatives →
- 18
See cost estimates for Terraform right in your editor
2022 · github.com · its alternatives →
- 19
Dastardlyâ–˛57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
- 20
TFKitâ–˛6Terraform intelligence & analysis suite
Nov 2025 · tfkit.netlify.app · its alternatives →
- 21
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com · its alternatives →
- 22
We're open-sourcing Sighthound today, our rules-based static security scanner. What makes it special is that it's coded in rust and uses tree-sitter as it's AST making it very fast and easily extensible. Why build another scanner in 2026? We wanted to improve some of our detection outcomes but noticed the current open source scanners like Semgrep/Opengrep we're capped by a bunch of adoption limitations such as being written in OCaml, requiring a lot of work to add a language parser, and the rulesets were licensed differently and required paid offerings. It also felt that licensing was…
Jul 2026 · github.com · its alternatives →
- 23CA
2020 · scaffold.sh · its alternatives →
- 24
Also compare
- DeepSource for Go alternatives
- Tracexec – TUI for tracing execve and pre-exec behavior alternatives
- The CrowdSec Console alternatives
- Digger.dev – A PaaS that generates Terraform, in your AWS account alternatives
- Bearer – Open-source code security scanning solution (SAST) alternatives
- TFGaurd alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →