Skip to content
hackingtools.ai

Secrets & Software Supply Chain

Secrets & Software Supply Chain is the set of tools used to keep credentials out of code and to know what is inside the software you build and ship. It covers secret scanning in repos and pipelines, software composition analysis and SBOM-driven vulnerability matching, and policy checks on infrastructure-as-code before release. Tools here protect the path from source to production, not the runtime network or the end-user login box alone.

Filters
Pricing
Platform
Open source

10 tools

  • Snyk

    Snyk

    Developer security platform for finding and fixing issues in application code, open-source dependencies, containers and infrastructure as code.

    Application SecurityFreemium
    1
  • Grype

    Grype

    Grype is a free open-source vulnerability scanner from Anchore used to find known flaws in container images, filesystems, and SBOMs for DevSecOps teams.

    Vulnerability ManagementFreeOpen source
    0
  • Gitleaks

    Gitleaks

    Gitleaks is a free open-source secret scanner used to detect hardcoded passwords, API keys, and tokens in git repos and files for security and dev teams.

    Application SecurityFreeOpen source
    0
  • Checkov

    Checkov

    Checkov is a free static analysis tool used to find misconfigurations in infrastructure as code and open source packages for cloud and DevSecOps teams.

    Cloud SecurityFreeOpen source
    0
  • GitGuardian

    GitGuardian

    GitGuardian detects and remediates leaked secrets across code, CI/CD and collaboration tools, with a free plan for small teams and paid business tiers.

    Application SecurityFreemium
    0
  • TruffleHog

    TruffleHog

    TruffleHog finds and verifies leaked secrets across git, cloud storage and CI artefacts, with a free open-source scanner and commercial TruffleHog Enterprise.

    Application SecurityFreemiumOpen source
    0
  • Trivy

    Trivy

    Aqua Security's open-source scanner for vulnerabilities, misconfigurations, secrets and SBOMs across containers, code, Kubernetes and cloud targets.

    Cloud SecurityFreeOpen source
    0
  • Semgrep

    Semgrep

    Semgrep is a fast, open-source static analysis engine that finds bugs and security issues in code with pattern rules and ready-made rule packs.

    Application SecurityFreemiumOpen source
    0