Open-source Snyk alternatives: 8 security testing tools
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
About Snyk
Snyk's site lists products that check source code, open-source dependencies, container images and infrastructure as code. source: Snyk home page
Snyk is not listed on FreeQATools: the directory lists only tools released under an OSI-approved license (see the inclusion rules). No metrics are shown for it.
Order: Listed tools in the category that are not archived, by GitHub stars. Each line gives one fact from the tool's own documentation, with its source.
8 open-source tools
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
ZAP: Scan targets: Web applications. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
Repository metrics
| sqlmap | 38,4921 | 2026-01-0111.10 | 2026-09-201 | GPL-2.0-or-later | Python | active |
|---|---|---|---|---|---|---|
| Trivy | 38,0091 | 2026-08-141v0.74.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nuclei | 31,4311 | 2026-08-081v3.11.1 | 2026-09-221 | MIT | Go | active |
| Gitleaks | 29,4281 | 2026-03-211v8.30.1 | 2026-07-221 | MIT | Go | active |
| Promptfoo | 25,3711 | 2026-09-1810.123.1 | 2026-09-221 | MIT | TypeScript | active |
| ffuf | 16,7031 | 2026-09-091v2.3.0 | 2026-09-091 | MIT | Go | active |
| ZAP | 15,8041 | 2025-12-151v2.17.0 | 2026-09-171 | Apache-2.0 | Java | active |
| OSV-Scanner | 11,0731 | 2026-09-141v2.6.0 | 2026-09-221 | Apache-2.0 | Go | active |
1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.