Trivy alternatives: 8 open-source security testing tools
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
About Trivy
Trivy is a listed security testing tool: Security scanner for container images, filesystems, Git repositories, VM images and Kubernetes, covering CVEs, misconfigurations, secrets and licenses.
Order: Listed tools in the same category, with tools in the same primary language (GitHub API) first, then by GitHub stars. Each line gives one fact from the tool's own documentation where it differs from what Trivy's documentation states, with its source.
8 alternatives to Trivy
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ZAP: Scan targets: Web applications. source: README
Nikto: Scan targets: Web servers: potentially dangerous files or programs, outdated server components. source: Docs: Overview & Description
Repository metrics
| sqlmap | 38,4921 | 2026-01-0111.10 | 2026-09-201 | GPL-2.0-or-later | Python | active |
|---|---|---|---|---|---|---|
| Trivy | 38,0091 | 2026-08-141v0.74.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nuclei | 31,4311 | 2026-08-081v3.11.1 | 2026-09-221 | MIT | Go | active |
| Gitleaks | 29,4281 | 2026-03-211v8.30.1 | 2026-07-221 | MIT | Go | active |
| Promptfoo | 25,3711 | 2026-09-1810.123.1 | 2026-09-221 | MIT | TypeScript | active |
| ffuf | 16,7031 | 2026-09-091v2.3.0 | 2026-09-091 | MIT | Go | active |
| ZAP | 15,8041 | 2025-12-151v2.17.0 | 2026-09-171 | Apache-2.0 | Java | active |
| OSV-Scanner | 11,0731 | 2026-09-141v2.6.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nikto | 10,7361 | 2026-07-3112.6.1 | 2026-08-151 | GPL-3.0-only | Perl | active |
1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.