Dev tools · alternatives · 2026
24 alternatives to TypeScript Security Scanner
Hi HN, I’m Guillaume, the cofounder of Bearer, an Open Source SAST solution. After launching a few weeks ago here on Hacker News with support for Ruby and JavaScript stacks, I’m happy to report we’ve just released a new version (v1.2) with TypeScript support! In terms of code coverage, we use the same rules already implemented for vanilla JavaScript, but as usual, you can build your own. The rules list is here: https://docs.bearer.com/reference/rules/ It’s a first version for TS, but we believe that thanks to the pre-existing JavaScript support it should already…
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. TypeScript Security Scanner launched in 2023; newer entries below may have overtaken it.
- 1BO
Hi HN, we’re the co-founders of Bearer, and today we launch an open-source alternative to code security solutions such as Snyk Code, SonarQube, or Checkmarx. Essentially, we help security & engineering teams to discover, filter and prioritize security risks and vulnerabilities in their codebase, with a unique approach through sensitive data (PII, PD, PHI). Our website is at https://www.bearer.com and our GitHub is here: https://github.com/bearer/bearer We are not originally Security experts but have been software developers and engineering leaders for over 15…
2023 · its alternatives →
- 2
Hello there, I’m Guillaume, the cofounder and CEO of Bearer, a code security startup trying to rethink security products for a developer-first World. 7 months ago we introduced on HN, Bearer CLI (https://github.com/Bearer/bearer), our free and open code security scanner supporting at the time only Ruby and JavaScript applications. We’ve been working very hard with the team, thanks to community feedback to bring tons of new features as well as more language support to become everyone’s go-to code security solution. Just to name a few major features: - Native integration…
2023 · github.com · its alternatives →
- 3
This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…
2024 · github.com · its alternatives →
- 4AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io · its alternatives →
- 5
Open sourcing Ezno's checker and trying out / previewing the JavaScript type checker today
2023 · github.com · its alternatives →
- 6
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
- 7
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like Rust have built-in protection but languages like JavaScript, TypeScript, and Python do not. This library attempts to mitigate these vulnerabilities for TypeScript and JavaScript. How: Regolith uses Rust's Regex library under the hood to prevent ReDoS attacks. The Rust Regex library…
2025 · github.com · its alternatives →
- 8
- 9
We've been building Crust (https://crustjs.com/), a TypeScript-first, Bun-native CLI framework with zero dependencies. It's been powering our core product internally for a while, and we're now open-sourcing it. The problem we kept running into: existing CLI frameworks in the JS ecosystem are either minimal arg parsers where you wire everything yourself, or heavyweight frameworks with large dependency trees and Node-era assumptions. We wanted something in between. What Crust does differently: - Full type inference from definitions — args and flags are inferred automatically. No…
Mar 2026 · github.com · its alternatives →
- 10
Hey HN! I built Typebase, a library that gives you Convex's DX with Supabase's openness. After trying Supabase I liked how fast it is to spin up a DB and auth, but really didn't like using RLS and SQL for authorization. With Convex I loved how your server "lives" in your code, but disliked the DB model and the realtime-first defaults. With Typebase you just write TS files inside a typebase/ folder in your existing repo. You can define your DB tables inside a schema.ts file and export server functions that your frontend calls like local functions, fully typed. Auth is built in. Then one…
Aug 2026 · typebase.io · its alternatives →
- 11
Hello, folks. I'm Jiang, the author of ESInfer. I love writing Javascript because it has a prosperous ecosystem and is quick to get my hands dirty. However, sometimes it's painful when the flow is not fast to follow due to the lack of a type system. To solve this, I wrote ESInfer, a statical inference tool, to automatically type check and generate type annotations for Javascript. It works with pure Javascript without any add-ons to the language or user-space code and supports highly dynamic features, such as the modification of prototypes. It is still in the very early stage, which offers…
2022 · esinfer.com · its alternatives →
- 12
:icecream: vanillatype - Lightweight runtime types for vanilla JS and Node - crisdosaygo/vanillatype
2020 · github.com · its alternatives →
- 13
Hi Hacker News! My name is Sagar, I’m working on a startup called Speakeasy - we’re making all APIs self-service. The platform is currently in beta, but we’re independently launching this tool which you can use to generate language-idiomatic, statically-typed TS SDKs from any public OpenAPI schemas. We hope to continue iterating on this to give devs a way to easily generate high fidelity client SDKs for all the major languages. Inspiration for this product is from past experiences struggling with OpenAPI. I was originally optimistic about using the OpenAPI tools to build out our offering,…
2022 · easysdk.xyz · its alternatives →
- 14SI
Identify and remediate code security and privacy risks in your DevSecOps workflows.
2018 · bearer.sh · its alternatives →
- 15AS
Took a stab at building my own string diffing JS package. I built an interactive demo for TypeIt’s website (https://typeitjs.com/build-your-own) a while back. The approach I took to handle user input necessitated a way to calculate the difference between the versions of a user’s text input. I searched around for a package to help me out and found a couple of good ones (like fast-diff), but I either didn’t really like their API or didn’t want to take on a huge new dependency. Instead, I thought I’d give it a shot myself (famous last words). I dove into it having no real formal…
2022 · its alternatives →
- 16
- 17
I built Morph, an experimental fullstack HTML-first library for Deno, Node, and Bun. Everything returns HTML, not JSON. No React, no Vite — just plain HTML with server-side rendering. No build steps, no preprocessors, no complex configs — everything runs from a single file. Perfect for Telegram Web Apps, internal tools, simple admin panels, dashboards, or anywhere a full-blown SPA feels like overkill. Important: I built this entirely for myself — to solve my own problems. I hate complex frontend. I hate writing it. And I don’t want to waste time on it. But maybe it’ll help you too.
2025 · github.com · its alternatives →
- 18
For the past few months we’ve been building a simple jest/typescript-based high-level language for writing and running integration tests. We're open-sourcing it now and are excited to share it with you: https://github.com/traceloop/jest-opentelemetry Why we built this: - There are many solid frameworks for FE / browser testing, but none with high-level constructs for testing BE flows - We were missing a way to validate side effects for complex backend systems, especially across async queueing systems Our beta version lets you send an API call to a system and…
2023 · github.com · its alternatives →
- 19
Hi HN, I'm Dan Draper, founder of CipherStash. We've spent 5 years building per-value searchable encryption tech. We realized that encryption like this is incredibly powerful but the engineering required is generally not worth the effort. So we built a platform and opensource SDK to take the cry out of cryptography :) CipherStash Stack is: * A searchable encryption SDK for TS and Postgres * Fast, key management with Zerokms (backed by HSM) * A transparent SQL proxy * Auth library and OIDC federation service * Skills for data security Integrations include Prisma Next, Drizzle, Auth0, Clerk…
May 2026 · cipherstash.com · its alternatives →
- 20
We're open-sourcing Sighthound today, our rules-based static security scanner. What makes it special is that it's coded in rust and uses tree-sitter as it's AST making it very fast and easily extensible. Why build another scanner in 2026? We wanted to improve some of our detection outcomes but noticed the current open source scanners like Semgrep/Opengrep we're capped by a bunch of adoption limitations such as being written in OCaml, requiring a lot of work to add a language parser, and the rulesets were licensed differently and required paid offerings. It also felt that licensing was…
Jul 2026 · github.com · its alternatives →
- 21
Spent a week in the break building a pre-compiler that brings type safety to runtime. Still pretty early, but generally does what it says. Looking for feedback, code that breaks it (check out the playground), ideas etc.
Jan 2026 · typical.elliots.dev · its alternatives →
- 22
As a developer of typia, have to alive in the new typescript-go era, I made a new toolchain for tsgo. Making the ttsc, I understood that the new plugin toolchain system can dramatically reduce lint rule checking time by integrating into the typescript-go. So made `@ttsc/lint`, and its time is 600x to 1600x faster than eslint. From now on, when you compile TypeScript, lint violations would be caught in the same time. No more need to run both `tsgo` and `eslint` independently. > This repository is not v1 yet because the typescript-go has not been released yet, but if you wanna experience…
Jul 2026 · github.com · its alternatives →
- 23
Hello everyone, For the past several months, I have been building multiple React/TailwindCSS components for my projects. I have decided to bundle and document them so that I can share them with the community. The entire UI kit is written in Typescript on top of the class-variance-authority library. Although I am already using these components in production, the project is still in beta since it lacks a full test suite and dark mode. Please feel free to take a look and provide feedback if you have a moment to spare. Thank you!
2023 · rewind-ui.dev · its alternatives →
- 24
TypeScript as a proof assistant. GitHub Gist: instantly share code, notes, and snippets.
2025 · gist.github.com · its alternatives →
Also compare
- Bearer – Open-source code security scanning solution (SAST) alternatives
- Bearer Code Security Scanner Add Support for Java, PHP, Go, and Python alternatives
- Execute JavaScript in a WebAssembly QuickJS sandbox alternatives
- A minimal TS library that generates prompt injection attacks alternatives
- Ezno, a TypeScript checker written in Rust, is now open source alternatives
- Socket – Secure your JavaScript supply chain alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →