Open Source Tools · Category
Software composition analysis: inventory the open-source components in your software, produce SBOMs and match them against vulnerability databases.
Alternatives toSnykSonatype Lifecycle
8 tools
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Vulnerability scanner for images, file systems and SBOMs
Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.
Dependency scanner backed by the OSV database
Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.
SBOM generator for images and file systems
CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.
Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
Software composition analysis for known vulnerable libraries
OWASP software composition analysis tool that identifies project dependencies and checks them for publicly disclosed vulnerabilities.
Vulnerability management and DevSecOps findings platform
Web platform that imports findings from many security scanners, deduplicates them and tracks remediation across products and engagements.
Continuous SBOM analysis platform
OWASP platform that ingests CycloneDX SBOMs and continuously tracks component risk, vulnerabilities and licence policy across a whole portfolio.
