Free for Open Source Application Security Tools

Last updated: February 8, 2026Reviewed date: February 8, 2026Reading time: 15 min read
Patient Tools

Read, save, and share this guide

Use these quick tools to make this medical article easier to read, print, save, or share with a family member.

Article Summary

OWASP's mission is to help the world improve the security of its software. One of the best ways OWASP can do that is to help Open Source developers improve the software they are producing that everyone else relies on. As such, the following lists of automated vulnerability detection tools that are free for open source projects have been gathered together here to raise awareness of their availability. We would...

Key Takeaways

  • This article explains Free for Open Source Tools in simple medical language.
Educational health guideWritten for patient understanding and clinical awareness.
Reviewed content workflowUse writer and reviewer profiles for stronger trust.
Emergency safety firstUrgent warning signs are highlighted below.

Seek urgent medical care if you notice

These warning signs are general safety guidance. Local emergency numbers and clinical judgment should always come first.

  • Severe symptoms, breathing difficulty, fainting, confusion, or rapidly worsening illness.
  • New weakness, severe pain, high fever, or symptoms after a serious injury.
  • Any symptom that feels urgent, unusual, or unsafe for the patient.
1

Emergency now

Use emergency care for severe, sudden, rapidly worsening, or life-threatening symptoms.

2

See a doctor

Book a professional medical evaluation if symptoms persist, worsen, recur often, affect daily activities, or occur in a high-risk patient.

3

Learn safely

Use this article to understand possible causes, tests, treatment options, prevention, and questions to ask your clinician.

OWASP’s mission is to help the world improve the security of its software. One of the best ways OWASP can do that is to help Open Source developers improve the software they are producing that everyone else relies on. As such, the following lists of automated vulnerability detection tools that are free for open source projects have been gathered together here to raise awareness of their availability.

We would encourage open source projects to use the following types of tools to improve the security and quality of their code:

Disclaimer: OWASP does not endorse any of the Vendors or Scanning Tools by listing them below. They are simply listed if we believe they are free for use by open source projects. We have made every effort to provide this information as accurately as possible. If you are the vendor of a free for open source tool and think this information is incomplete or incorrect, please send an e-mail to dave.wichers (at) owasp.org and we will make every effort to correct this information.

Free for Open Source Tools

Tools that are free for open source projects in each of the above categories are listed below.

SAST Tools

OWASP already maintains a page of known SAST tools: Source Code Analysis Tools, which includes a list of those that are “Open Source or Free Tools Of This Type”. Any such tools could certainly be used. One such cloud service is:

  • GitHub code scanning – A free for open source static analysis service that uses GitHub Actions and CodeQL to scan public repositories on GitHub. Supports C/C++, C#, Ruby (beta), Java, JavaScript/TypeScript, Python, and Go (see here for more information)
    • If you do not want to use GitHub Actions, you may use the CodeQL CLI; however, be sure to read the license terms in full.
    • By default, CodeQL only looks for high fidelity security related results (well known true positives), so your results may look different from LGTM.
    • To achieve the same or similar results provided by LGTM, try enabling the security-and-quality query suite within the CodeQL query pack.

In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:

  • Contrast CodeSec – Scan & Serverless – Web App and API code scanners via command line or through GitHub actions. CodeSec – Scan supports Java, JavaScript and .NET, while CodeSec – Serverless supports AWS Lambda Functions (Java + Python). These tools are actually free for all projects, not just open source.
  • Coverity Scan Static Analysis – Can be lashed into Travis-CI so it’s done automatically with online resources. Supports over a dozen programming languages.
  • HCL AppScan CodeSweep – This is a SAST community edition version of HCL AppScan. Free for everyone to use. The tool currently supports Python, Ruby, JS (Vue, Node, Angular, JQuery, React, etc), PHP, Perl, Go, TypeScript & more, with new languages being added frequently.
    • CodeSweep – VS Code Plugin – Scans files upon saving them. The results show the location of a finding, type, and remediation advice. Auto-fix available with free trial or subscription.
    • CodeSweep – JetBrains Plugin – Scans files upon saving them. The results show the location of a finding, type, and remediation advice. Auto-fix available with free trial or subscription.
    • CodeSweep – GitHub Action – Scan the new code on a push/pull request using a GitHub action. Findings are highlighted in the Files Changed view and details about the issue and mitigation steps can be found in the Actions page. Unrestricted usage allowed with a free trial account.
  • AppSweep – a free for everyone mobile application security testing tool for Android. It analyzes the compiled application and does not require access to the source code. The tool performs security assessment not only of the executable code but also of application resources and configuration file. Integration into CI/CD is supported.

DAST Tools

If your project has a web application component, we recommend running automated scans against it to look for vulnerabilities. OWASP maintains a page of known DAST Tools, and the License column on this page indicates which of those tools have free capabilities. Our primary recommendation is to use one of these:

  • ZAP – A full featured free and open source DAST tool that includes both automated scanning for vulnerabilities and tools to assist expert manual web app pen testing.

  • StackHawk – StackHawk is a commercially supported DAST tool built on ZAP and optimized to run in CI/CD (almost every CI supported) to test web applications during development and in CI/CD. The StackHawk platform allows you to manage findings over time in different environments. StackHawk is free for Open Source projects and free to use on a single application.

  • Arachni – Arachni is a commercially supported scanner, but its free for most use cases, including scanning open source projects.

  • VWT Digital’s sec-helpers – Collection of dynamic security related helpers. Sec-helpers is a bundle of useful tests and validators to ensure the security of a given domain.

  • OWASP purpleteam – A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. purpleteam is smart enough to know how to test, you just need to provide a Job file which tells purpleteam what you want tested. It has two main environments local and cloud.

    • local is OWASP – set everything up yourself in your own environment.
    • cloud is a proprietary offering with everything hosted for you in the cloud. You just need to configure and run the CLI.

    Purpleteam is pluggable, if it doesn’t have a tester that you need you can add your own. One of the testers (the web application tester) uses ZAP under the hood.

  • CI Fuzz CLI – An open source command line tool for creating fuzz tests. The tool is tightly integrated with various build systems, enabling developers to create fuzz tests as easily as unit tests.

  • Code Intelligence App – This application security testing platform enables CI/CD-integrated fuzz testing at each pull request. It helps developers to measure and maximize code coverage and to prioritize all findings based on severity. All of this information is then aggregated in a usable dashboard. The testing platform integrates directly into popular ticketing systems and issue trackers.

We are not aware of any other commercial grade tools that offer their full featured DAST product free for open source projects.

IAST Tools

IAST tools are typically geared to analyze Web Applications and Web APIs, but that is vendor specific. There may be IAST products that can perform good security analysis on non-web applications as well.

We are aware of only one IAST Tool that is free after registration at this time:

  • Contrast Community Edition (CE) – Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Contrast CE supports Java and .NET only.

API Web Scanners

For tools which are API specific please refer to the OWASP community API Security Tools page.

Open Source Software (OSS) Security Tools

OSS refers to the open source libraries or components that application developers leverage to quickly develop new applications and add features to existing apps. Gartner refers to the analysis of the security of these components as software composition analysis (SCA). So OSS Analysis and SCA are the same thing.

OWASP recommends that all software projects generally try to keep the libraries they use as up-to-date as possible to reduce the likelihood of Using Components with Known Vulnerabilities (OWASP Top 10-2017 A9). There are two recommended approaches for this:

Keeping Your Libraries Updated

Using the latest version of each library is recommended because security issues are frequently fixed ‘silently’ by the component maintainer. By silently, we mean without publishing a CVE for the security fix.

  • Maven Versions plugin
    • For Maven projects, can be used to generate a report of all dependencies used and when upgrades are available for them. Either a direct report, or part of the overall project documentation using: mvn site.
  • Dependabot
    • A GitHub only service that creates pull requests to keep your dependencies up-to-date. It automatically generates a pull request for each dependency you can upgrade, which you can then ignore, or accept, as you like. It supports tons of languages.
    • Recommended for all open source projects maintained on GitHub!

Detecting Known Vulnerable Components

As an alternative, or in addition to, trying to keep all your components up-to-date, a project can specifically monitor whether any of the components they use have known vulnerable components.

Free tools of this type:

  • OWASP has its own free open source tools:
  • GitHub: Security alerts for vulnerable dependencies
    • A native GitHub feature that reports known vulnerable dependencies in your GitHub projects. Supports: Java, .NET, JavaScript, Ruby, and Python. Your GitHub projects are automatically signed up for this service.
  • Bytesafe Dependency Firewall: Free for Open Source projects
    • Detects known vulnerabilities in source code dependencies,
    • Blocks dependencies based on policies such as vulnerabilities, type of license, release dates and more
  • Debricked: free for open source projects or smaller teams.
  • retire.js: free open source tool for finding javascript libraries with known vulnerabilities. Originally a command line tool, and there are plugins for browsers and scanners.

Commercial tools of this type that are free for open source:

  • Bytesafe – Bytesafe Dependency Firewall manages source code dependencies securely
  • Contrast Community Edition (CE) (mentioned earlier) also has both Known Vulnerable Component detection and Available Updates reporting for OSS. CE supports Java and .NET only.
  • Debricked – over 90% true positive rate in supported languages
    • Identifies, fixes and prevents known vulnerabilities through automation without the need to give access to your source code. Read more at https://debricked.com
    • Allows for vulnerability management and license compliance in the same tool
    • Features automated fix pull request to automatically fix vulnerabilities (currently only for javascript)
    • Features one of the most complete vulnerability databases
    • GitHub version: https://github.com/apps/debricked/
  • OX Security – Stop Attacks Across Your Software Supply Chain
    • Complete Software Supply Chain Security Solution, based on Pipeline Bill Of Materials
    • Manage your findings from a single location
      • Full visibility and end to end traceability over your software pipeline security from cloud to code.
      • Manage your findings, orchestrate DevSecOps activities, prevent risks and maintain software pipeline integrity
    • Automatically block risks introduced into the pipeline and ensure the integrity of each workload
    • Close Gaps in Security Tooling & Coverage
      • Avoid known security risks like Log4j and Codecov.
      • Prevent new attack types based on proprietary research and threat intel.
    • Improve CI/CD Security & Processes
      • Ensure the security and integrity of all cloud artifacts
      • Undertake security gap analysis and identify any blind spots.
    • Free tier for Open-Source projects
  • SOOS – Free Community Edition – Our no-hassle enrollment process for open source projects brings practical supply chain security to the masses.
    • Use our SCA tool with any public GitHub repository
    • C++, Node, Ruby, Python, Java, .Net, and more
    • Integrates with GitHub
    • Connect to Jira, Azure DevOps, or GitHub Issues
    • Robust license policies
    • Rich vulnerability dashboard
    • SBOM generation (SPDX/CycloneDX)
  • Snyk – Supports Node.js, Ruby, Java, Python, Scala, Golang, .NET, PHP – Latest list here: https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support
  • Software Health Indicator by YourSky.blue
  • SourceClear Now owned by Veracode. Supports: Java, Ruby, JavaScript, Python, Objective C, GO, PHP
  • Vulert – Supports Node.js, Ruby, Java, Python, Scala, Golang, .Net, PHP
    • A Commercial tool that identifies vulnerable components. It is free for open source.
  • WhiteSource – Supports 200+ programming languages.

Code Quality tools

Quality has a significant correlation to security. As such, we recommend open source projects also consider using good code quality tools. A few that we are aware of are:

  • SpotBugs – Open source code quality tool for Java

    • This is the active fork for FindBugs, so if you use Findbugs, you should switch to this.
    • SpotBugs users should add the FindSecBugs plugin (http://find-sec-bugs.github.io/) to their SpotBugs setup, as it significantly improves on the very basic security checking native to SpotBugs.

  • SonarQube

    • This is a commercially supported, very popular, free (and commercial) code quality tool. It includes most if not all the FindSecBugs security rules plus lots more for quality, including a free, internet online CI setup to run it against your open source projects. SonarQube supports numerous languages: https://www.sonarqube.org/features/multi-languages/

  • DeepScan – Supports JavaScript, TypeScript

    • DeepScan is a static code analysis tool and hosted service for inspecting JavaScript code. It checks possible run-time errors and poor code quality using data-flow analysis and provides results for the project’s code quality.
    • DeepScan is free for open source projects on GitHub.

  • MegaLinter – Multi-language Code Quality and Security checker

    • MegaLinter is an Open-Source tool that analyzes the consistency of your code, IAC, configuration, and scripts in your repository sources, to ensure all your projects repositories are clean and formatted whatever IDE/toolbox is used by their developers
    • More than 100 linters supporting 52 languages, 24 formats, 21 tooling formats, spelling and security
    • Ready to use out of the box, compliant with GitHub Actions, Gitlab CI, Azure Pipelines, Jenkins, Concourse, Drone CI, or even locally with mega-linter-runner
    • Highly configurable, without registration
    • 100% Open-Source and free for all uses, powered and backed by by OX Security

Security Tools Built into DevOps/CI Environments

  • GitLab – is building security into their platform and it is quickly evolving as described here: https://about.gitlab.com/direction/secure/#security-paradigm
  • Faraday – Open Source Vulnerability Manager
    • Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your terminal and get your work organized on the run. Faraday was made to let you take advantage of the available tools in the community in a truly multiuser way.
    • Community Version: public open source projects on Github

Secrets Detection Tools

Secrets detection is often confused with SAST because both scan through static source code. Secrets detection scan the default branch before deployment but can also scan through every single commit of the git history, covering every branch, even development or test ones.

  • Yelp/detect-secrets – Open Source

    • detect-secrets is an aptly named module for detecting secrets within a code base. Unlike other similar packages that solely focus on finding secrets, this package is designed with the enterprise client in mind: providing a backwards compatible means to prevent new secrets from entering the code base.

  • Gitleaks – Gitleaks is a fast, light-weight, portable, and open-source secret scanner for git repositories, files, and directories

  • GitGuardian

    • A commercial tool that scans your Git repositories’ history and monitors new contributions in real-time for secrets. It examines secret exposure trends over time and monitors team performance. It is free for open source repositories hosted under your GitHub Organization: https://www.gitguardian.com/pricing
    • Container Scanning ggshield is a command-line interface application to help developers detect and prevent vulnerabilities like hard coded secrets (like API keys, certificates, database connection URLs) before pushing their code to shared repositories. ggshield is integrated with GitGuardian Internal Monitoring, the automated secrets detection and remediation platform. Recently, ggshield has also integrated the capability of scanning Terraform files for infrastructure-as-code for security misconfigurations (public beta).

  • SAP/Credential Digger – Open Source

    • A GitHub scanning tool that identifies hardcoded credentials (Passwords, API Keys, Secret Keys, Tokens, personal information, etc.), filtering the false positive data through machine learning models.

  • TruffleHog – Open Source (supported by an enterprise product: Truffle Security)

    • Find credentials in repositories (git, GitHub, GitLab), filesystem, S3 buckets, GCS buckets, syslog, CircleCI, Docket Images
    • Eliminates false positives using 700+ credential detectors that support active verification against their respective APIs
    • Available as a Github Action

Please let us know if you are aware of any other high quality application security tools that are free for open source (or simply add them to this page). We are particularly interested in identifying and listing commercial tools that are free for open source, as they tend to be better and easier to use than open source (free) tools. If you are aware of any missing from this list, please add them, or let us know (dave.wichers (at) owasp.org) and we’ll confirm they are free, and add them for you. Please encourage your favorite commercial tool vendor to make their tool free for open source projects as well!!

Patient safety assistant

Check your symptom safely

Hi, I am RX Symptom Navigator. I can help you understand what to read next and what warning signs need care.
Warning: Do not use this in emergencies, pregnancy, severe illness, or as a substitute for a doctor. For children or teens, use with a parent/guardian and clinician.
A rural-friendly guide: warning signs, when to see a doctor, related articles, tests to discuss, and OTC safety education.
1 Symptom 2 Severity 3 Safe guidance
First safety question

Is there chest pain, breathing trouble, fainting, confusion, severe bleeding, stroke-like weakness, severe injury, or pregnancy danger sign?

Choose quickly

Browse by body area
Start here: Write or select a symptom. The guide will show warning signs, doctor guidance, diagnostic tests to discuss, OTC safety education, and related RX articles.

Important: This tool is educational only. It cannot diagnose, treat, or replace a doctor. OTC information is not a prescription. In an emergency, contact local emergency services or go to the nearest hospital.

Doctor visit helper

Prepare before seeing a doctor

A simple rural-patient checklist to help you explain symptoms clearly, ask better questions, and avoid unsafe self-treatment.

Safety note: This is not a prescription or diagnosis. For severe symptoms, pregnancy danger signs, children with serious illness, chest pain, breathing difficulty, stroke-like weakness, or major injury, seek urgent care.

Which doctor may help?

Start with a registered doctor or the nearest qualified health center.

What to tell the doctor

  • Write when the problem started and how it changed.
  • Bring old prescriptions, investigation reports, and current medicines.
  • Write allergies, pregnancy status, diabetes, kidney/liver disease, and major past illnesses.
  • Bring one family member if the patient is weak, elderly, confused, or a child.

Questions to ask

  • What is the most likely cause of my symptoms?
  • Which danger signs mean I should go to hospital quickly?
  • Which tests are necessary now, and which can wait?
  • How should I take medicines safely and what side effects should I watch for?
  • When should I come for follow-up?

Tests to discuss

  • Vital signs: temperature, pulse, blood pressure, oxygen saturation
  • Basic physical examination by a clinician
  • CBC, urine test, blood sugar, or imaging only when clinically needed

Avoid these mistakes

  • Do not use antibiotics, steroid tablets/injections, or strong painkillers without proper medical advice.
  • Do not hide pregnancy, kidney disease, ulcer, allergy, or blood thinner use.
  • Do not delay emergency care when danger signs are present.

Medicine safety and first-aid guide

This section is for patient education only. It does not replace a doctor, pharmacist, or emergency care.

Safe first steps

  • Avoid heavy lifting, sudden bending, and prolonged bed rest.
  • Use comfortable posture and gentle movement as tolerated.
  • Discuss physiotherapy, X-ray, or MRI only when clinically needed.

OTC medicine safety

  • For mild back pain, pain-relief medicine may be discussed with a doctor or pharmacist.
  • Avoid repeated painkiller use if you have kidney disease, stomach ulcer, uncontrolled blood pressure, or are taking blood thinners.

Avoid these mistakes

  • Do not start antibiotics without a proper medical decision.
  • Do not use steroid tablets or injections casually for quick relief.
  • Do not delay emergency care because of home remedies.

Get urgent help if

  • Back pain with leg weakness, numbness around private area, loss of urine/stool control, fever, cancer history, or major injury needs urgent care.
Medicine names, dose, and timing must be decided by a qualified clinician or pharmacist after checking age, pregnancy, allergy, other diseases, and current medicines.

For rural patients and family caregivers

Patient health record and symptom diary

Write your symptoms, medicines already taken, test results, and questions before visiting a doctor. This note stays on your device unless you print or copy it.

Doctor to discuss: Doctor / qualified healthcare provider
Tests to discuss with doctor
  • Basic vital signs: temperature, pulse, blood pressure, oxygen level if needed
  • Relevant blood, urine, imaging, or specialist tests only after clinical assessment
Questions to ask
  • What is the most likely cause of my symptoms?
  • Which warning signs mean I should go to emergency care?
  • Which tests are really needed now?
  • Which medicines are safe for my age, pregnancy status, allergy, kidney/liver/stomach condition, and current medicines?

Emergency warning signs such as chest pain, severe breathing difficulty, sudden weakness, confusion, severe dehydration, major injury, or loss of bladder/bowel control need urgent medical care. Do not wait for online information.

Safe pathway to proper treatment

Back pain care roadmap

Use this simple roadmap to understand the next safe steps. It is educational and does not replace examination by a doctor.

Go to emergency care if you notice:
  • New leg weakness, numbness around private area, or loss of bladder/bowel control
  • Back pain after major injury, fever, unexplained weight loss, cancer history, or severe night pain
Doctor / service to discuss: Orthopedic/spine specialist, physical medicine doctor, physiotherapist under guidance, or qualified clinician.
  1. Step 1

    Check danger signs first

    If danger signs are present, seek emergency care and do not wait for online information.

  2. Step 2

    Record the symptom story

    Write when symptoms started, severity, medicines already taken, allergies, pregnancy status, and test results.

  3. Step 3

    Visit a qualified clinician

    A doctor, nurse, or qualified healthcare provider can examine you and decide which tests or treatment are needed.

  4. Step 4

    Do only useful tests

    Discuss neurological examination first. X-ray or MRI may be needed only when red flags, injury, nerve weakness, or persistent severe symptoms are present.

  5. Step 5

    Follow up and return early if worse

    If symptoms worsen, new warning signs appear, or treatment is not helping, return for review quickly.

Rural patient practical tips
  • Take a written symptom diary and all previous prescriptions/test reports.
  • Do not hide medicines already taken, even herbal or over-the-counter medicines.
  • Ask which warning signs mean urgent referral to hospital.
  • Avoid forceful massage or bone-setting when there is weakness, injury, fever, or nerve symptoms.

This roadmap is for education. A real diagnosis and treatment plan requires history, examination, and clinical judgment.

RX Patient Help

Ask a health question safely

Write your symptom story. A health professional or site editor can review it before any answer is prepared. This box is not for emergency care.

Emergency first: Severe chest pain, breathing trouble, unconsciousness, stroke signs, severe injury, heavy bleeding, or rapidly worsening symptoms need urgent local medical care now.

Frequently Asked Questions

Is this article a replacement for a doctor?

No. It is educational content only. Patients should consult a qualified clinician for diagnosis and treatment.

When should I seek urgent care?

Seek urgent care for severe symptoms, rapidly worsening condition, breathing difficulty, severe pain, neurological changes, or any emergency warning sign.

References

Add references, clinical guidelines, textbooks, journal articles, or trusted medical sources here. You can edit this area from the RX Article Professional Blocks panel.

More from this topic
  1. Transient Blockage of the Internal Iliac Artery

    The internal iliac artery is a crucial blood vessel in the pelvis, responsible for supplying blood to various organs and tissues in the lower abdomen and...

    January 25, 2024 • Rx iT World Hacking Tutorial
  2. GraphQL

    GraphQL is an open source query language originally developed by Facebook that can be used to build APIs as an alternative to REST and SOAP. It has...

    January 25, 2024 • Rx iT World Hacking Tutorial
  3. Forgot Password Service

    In order to implement a proper user management system, systems integrate a Forgot Password service that allows the user to request a password reset. Even though this functionality...

    January 25, 2024 • Rx iT World Hacking Tutorial
  4. File upload

    File upload is becoming a more and more essential part of any application, where the user is able to upload their photo, their CV, or a...

    January 25, 2024 • Rx iT World Hacking Tutorial
  5. Error Handling

    Error handling is a part of the overall security of an application. Except in movies, an attack always begins with a Reconnaissance phase in which the attacker will...

    January 25, 2024 • Rx iT World Hacking Tutorial
  6. The .NET Framework

    The .NET Framework is Microsoft’s principal platform for enterprise development. It is the supporting API for ASP.NET, Windows Desktop applications, Windows Communication Foundation services, SharePoint, Visual...

    January 25, 2024 • Rx iT World Hacking Tutorial
  7. Docker Containerization Technology

    Docker is the most popular containerization technology. Upon proper use, it can increase the level of security (in comparison to running applications directly on the host)....

    January 25, 2024 • Rx iT World Hacking Tutorial
  8. Django framework is a powerful Python web framework

    The Django framework is a powerful Python web framework, and it comes with built-in security features that can be used out-of-the-box to prevent common web vulnerabilities....

    January 25, 2024 • Rx iT World Hacking Tutorial
  9. Django REST Framework

    The Django REST framework abstracts developers from quite a bit of tedious work and provides the means to build APIs quickly and with ease using Django....

    January 24, 2024 • Rx iT World Hacking Tutorial
  10. Guidance on Deserializing Objects Safely

    Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them for...

    January 24, 2024 • Rx iT World Hacking Tutorial