
42 developer tools in this category
Scanning, secrets management, identity, and the tooling that finds problems before attackers do.
Security tooling here covers a few distinct jobs: finding vulnerabilities in your own code, finding them in your dependencies, managing secrets, and handling identity and access.
Dependency scanning is the highest-return starting point for most teams — the majority of exploitable surface arrives through packages nobody reviewed, and automated alerts on known CVEs are cheap to adopt. Static analysis of your own code is next, though it needs tuning: a scanner that cries wolf gets ignored, which is worse than not having one.
Secrets management and identity are less about finding problems and more about not creating them. Hardcoded credentials remain one of the most common real-world breaches, and the fix is boring and effective. Treat the tools in this category as complements rather than alternatives: they address different failure modes, and none of them substitute for the others.



Developer security platform for finding and fixing vulnerabilities




Protect passwords and secrets, manage app access, and secure AI tools with 1Password. Easy to adopt from growing teams to enterprise.

Detect, pentest, and block security threats across your entire stack - from one unified platform.

The Cloud Native Application Protection Platform (CNAPP) enables ganizations to secure every cloud native application everywhere, from code commit to runtime.



Chainguard provides trusted open source artifacts for every layer of your modern software stack—containers, language libraries, and VM images.

Checkmarx agentic application security software platform Combines Hybrid scanning, AI-powered agents, and unified risk intelligence across every attack surface

The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.


Doppler's secrets management platform helps teams secure, sync, and automate secrets across cloud and on-prem environments with security and developer-friendly workflows.

Why Falco? Strengthen container security The flexible rules engine allows you to describe any type of host or container behavior or activity. Reduce risk via immediate alerts You can immediately respond to policy violation alerts and integrate Falco within your response workflows. Leverage most current detection rules Falco out-of-the box rules alert on malicious activity and CVE exploits.

FOSSA secures the software supply chain — automated SBOM generation, software composition analysis (SCA), open source license compliance, and vulnerability management.

Secure your SDLC and Non-Human Identities (NHIs) with GitGuardian 🔐 — detect secrets in code, repos, and tools. Available as SaaS or Self-Hosted.

HackerOne combines AI with the ingenuity of the largest community of security researchers to find and fix security, privacy, and AI vulnerabilities across the SDLC. HackerOne offers AI red teaming, crowdsourced security, bug bounty, vulnerability disclosure and pentesting.

Imperva provides complete cyber security by protecting what really matters most—your data and applications—whether on-premises or in the cloud.

Infisical is the all-in-one identity security platform for developers, machines, and AI agents. Manage identities, secrets, certs, and access.

Accurate and automated application security testing that scales like no other solution. Secure thousands of websites, applications, and APIs with the industry’s only DAST-first AppSec platform.

Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum effort.

Let's Encrypt is a free, automated, and open Certificate Authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2025 Annual Report.

Traditional application security misses AI risk. Standalone AI security tools miss your code. Mend.io closes the gap with unified security for AppSec and AI.

Nmap Free Security Scanner, Port Scanner, & Network Exploration Tool. Download open source software for Linux, Windows, UNIX, FreeBSD, etc.

Ory delivers identity and access management (IAM) for applications, enterprises, and AI agents. Cloud-native, API-first, and self-hostable.

PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.

Neo applies reasoning, memory, and real execution across the delivery lifecycle — so security keeps up with continuously shipped software.

An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.

Sonatype provides intelligence & automated governance to help you build faster & safer with open source and AI. From the creators of Nexus Repository.

Teleport unifies human, machine, and AI identities with strong identity implementation to speed up engineering, improve resiliency, and secure AI in production.

The leader in exposure management and AI security, Tenable cybersecurity solutions reduce cyber risk across IT, OT, cloud, identity & hybrid attack surfaces.

Trivy is the most popular open source security scanner for Vulnerability &, IaC, SBOM discovery, cloud scanning and Kubernetes security

Truffle Security is an open-source security software company that secures sensitive data by automatically detecting and remediating leaked keys and credentials.

Vanta automates the complex and time-consuming process of SOC 2, HIPAA, ISO 27001, PCI, and GDPR compliance certification. Automate your security monitoring in weeks instead of months.

Adaptive application security for the AI era. Build and run secure software from code to cloud with Veracode.


Wiz connects code, cloud, and runtime into one agentic cybersecurity platform. Prevent risk, detect threats, and start secure – across every cloud and AI layer.

Developer APIs/SDKs for Enterprise Ready features like Single Sign-On, Directory Sync, Audit Logging, and more. Get started for free.

ZITADEL is the identity infrastructure platform that is built for developers and works for all users and applications.