Skip to content

Back to the catalog

OWASP Free AppSec Tools
owasp.orgarticle

OWASP Free AppSec Tools

OWASP's community-maintained catalog of application security tools that are free for open source projects, organized by category: SAST (GitHub CodeQL, Coverity, HCL AppScan CodeSweep), DAST (OWASP ZAP, StackHawk, Akto, Arachni), IAST (Contrast CE), software composition analysis/dependency scanning (Dependabot, Snyk, Mend, retire.js, Debricked), secrets detection (Gitleaks, TruffleHog, GitGuardian, Kingfisher), code quality (SonarQube, SpotBugs, MegaLinter), CI/CD security (GitLab built-ins, Faraday), and automatic remediation (Mobb, Corgea). It also covers newer entrants like Zennoxa Shield, cloud-audit, Cynative, and post-quantum crypto risk tools (CARAF, PQBench). Serves as a practical shopping list for securing an OSS project's SDLC end-to-end.

TL;DR OWASP's curated, category-by-category list of free AppSec tools (SAST/DAST/IAST/SCA/secrets/code-quality) for open source projects.
Open original ↗

Organisations named here

  • OWASP Top 10-2017 A9

Technologies named here

  • GitHub code scanning
  • CodeQL CLI
  • Contrast CodeSec - Scan & Serverless
  • Coverity Scan Static Analysis
  • HCL AppScan CodeSweep
  • Aikido
  • Arnica
  • Corgea
  • KICS by Checkmarx
  • Kusari
  • Xygeni
  • Zennoxa Shield
  • ZAP by Checkmarx
  • OWASP PurpleTeam
  • Akto
  • Arachni
  • Barrion
  • CI Fuzz CLI
  • Code Intelligence App
  • StackHawk
  • VWT Digital's sec-helpers
  • WuppieFuzz
  • Xygeni DAST
  • Contrast Community Edition
  • Maven Versions plugin
  • Dependabot
  • GitHub Security alerts for vulnerable dependencies
  • Bytesafe Dependency Firewall
  • Debricked
  • retire.js
  • BomLens
  • OX Security
  • SOOS - Free Community Edition
  • Snyk
  • Software Health Indicator by YourSky.blue
  • Veracode SCA
  • Spectra Assure Community by ReversingLabs
  • Vulert
  • Mend
  • SpotBugs
  • FindSecBugs plugin
  • SonarQube
  • DeepScan
  • MegaLinter
  • AWS Firewall Factory
  • DSSRF
  • DepsGuard
  • cloud-audit
  • Cynative
  • GitLab
  • Faraday
  • Xygeni CI/CD & Build Security
  • 2MS by Checkmarx
  • GitGuardian
  • ggshield
  • Gitleaks
  • SAP/Credential Digger
  • TruffleHog
  • Yelp/detect-secrets
  • Kingfisher
  • Xygeni Secrets
  • xCOMPASS
  • Gitxray
  • Mobb
  • CARAF
  • PQBench
  • OWASP Zap
  • CodeQL
  • GitHub Actions

Techniques named here

  • Static Application Security Testing
  • Dynamic Application Security Testing
  • Interactive Application Security Testing
  • Software Composition Analysis / OSS Analysis
  • Secrets detection
  • Fuzz testing
  • Code Quality Analysis
  • Container Scanning
  • Infrastructure as Code Scanning
  • Automatic Remediation
  • Post-Quantum Cryptography Migration

Related in AppSec