Free for Open Source Application Security Tools

OWASP’s mission is to help the world improve the security of its software. One of the best ways OWASP can do that is to help Open Source developers improve the software they are producing that everyone else relies on. As such, the following lists of automated vulnerability detection tools that are free for open source projects have been gathered together here to raise awareness of their availability.

We would encourage open source projects to use the following types of tools to improve the security and quality of their code:

• Static Application Security Testing (SAST) Tools
• Dynamic Application Security Testing (DAST) Tools
  • (Primarily for web apps)

  Disclaimer: OWASP does not endorse any of the Vendors or Scanning Tools by listing them below. They are simply listed if we believe they are free for use by open source projects. We have made every effort to provide this information as accurately as possible. If you are the vendor of a free for open source tool and think this information is incomplete or incorrect, please send an e-mail to dave.wichers (at) owasp.org and we will make every effort to correct this information.

  Free for Open Source Tools

  Tools that are free for open source projects in each of the above categories are listed below.

  SAST Tools

  OWASP already maintains a page of known SAST tools: Source Code Analysis Tools, which includes a list of those that are “Open Source or Free Tools Of This Type”. Any such tools could certainly be used. One such cloud service is:

  • GitHub code scanning - A free for open source static analysis service that uses GitHub Actions and CodeQL to scan public repositories on GitHub. Supports C/C++, C#, Ruby (beta), Java, JavaScript/TypeScript, Python, and Go (see here for more information)
    • If you do not want to use GitHub Actions, you may use the CodeQL CLI; however, be sure to read the license terms in full.
    • By default, CodeQL only looks for high fidelity security related results (well known true positives), so your results may look different from LGTM.
    • To achieve the same or similar results provided by LGTM, try enabling the security-and-quality query suite within the CodeQL query pack.

    In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:

    • Contrast CodeSec - Scan & Serverless - Web App and API code scanners via command line or through GitHub actions. CodeSec - Scan supports Java, JavaScript and .NET, while CodeSec - Serverless supports AWS Lambda Functions (Java + Python). These tools are actually free for all projects, not just open source.
    • Coverity Scan Static Analysis - Can be lashed into Travis-CI so it’s done automatically with online resources. Supports over a dozen programming languages.
    • HCL AppScan CodeSweep - This is a SAST community edition version of HCL AppScan. Free for everyone to use. The tool currently supports Python, Ruby, JS (Vue, Node, Angular, JQuery, React, etc), PHP, Perl, Go, TypeScript & more, with new languages being added frequently.
      • CodeSweep - VS Code Plugin - Scans files upon saving them. The results show the location of a finding, type, and remediation advice. Auto-fix available with free trial or subscription.
      • CodeSweep - JetBrains Plugin - Scans files upon saving them. The results show the location of a finding, type, and remediation advice. Auto-fix available with free trial or subscription.
      • CodeSweep - GitHub Action - Scan the new code on a push/pull request using a GitHub action. Findings are highlighted in the Files Changed view and details about the issue and mitigation steps can be found in the Actions page. Unrestricted usage allowed with a free trial account.

      DAST Tools

      If your project has a web application component, we recommend running automated scans against it to look for vulnerabilities. OWASP maintains a page of known DAST Tools, and the License column on this page indicates which of those tools have free capabilities. Our primary recommendation is to use one of these:

      • ZAP - A full featured free and open source DAST tool that includes both automated scanning for vulnerabilities and tools to assist expert manual web app pen testing.
      • OWASP PurpleTeam - A security regression testing SaaS and CLI, perfect for inserting into your build pipelines. You don’t need to write any tests yourself. PurpleTeam is smart enough to know how to test, you just need to provide a Job file which tells PurpleTeam what you want tested. It has two main environments local and cloud .
        • local is OWASP - set everything up yourself in your own environment.
        • cloud is a proprietary offering with everything hosted for you in the cloud. You just need to configure and run the CLI.
          PurpleTeam is pluggable, if it doesn’t have a tester that you need you can add your own. One of the testers (the web application tester) uses ZAP under the hood.

        We are not aware of any other commercial grade tools that offer their full featured DAST product free for open source projects.

        IAST Tools

        IAST tools are typically geared to analyze Web Applications and Web APIs, but that is vendor specific. There may be IAST products that can perform good security analysis on non-web applications as well.

        We are aware of only one IAST Tool that is free after registration at this time:

        • Contrast Community Edition (CE) - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Contrast CE supports Java and .NET only.

        API Web Scanners

        For tools which are API specific please refer to the OWASP community API Security Tools page.

        Open Source Software (OSS) Security Tools

        OSS refers to the open source libraries or components that application developers leverage to quickly develop new applications and add features to existing apps. Gartner refers to the analysis of the security of these components as software composition analysis (SCA). So OSS Analysis and SCA are the same thing.

        OWASP recommends that all software projects generally try to keep the libraries they use as up-to-date as possible to reduce the likelihood of Using Components with Known Vulnerabilities (OWASP Top 10-2017 A9). There are two recommended approaches for this:

        Keeping Your Libraries Updated

        Using the latest version of each library is recommended because security issues are frequently fixed ‘silently’ by the component maintainer. By silently, we mean without publishing a CVE for the security fix.

        • Maven Versions plugin
          • For Maven projects, can be used to generate a report of all dependencies used and when upgrades are available for them. Either a direct report, or part of the overall project documentation using: mvn site.
          • A GitHub only service that creates pull requests to keep your dependencies up-to-date. It automatically generates a pull request for each dependency you can upgrade, which you can then ignore, or accept, as you like. It supports tons of languages.
          • Recommended for all open source projects maintained on GitHub!

          Detecting Known Vulnerable Components

          As an alternative, or in addition to, trying to keep all your components up-to-date, a project can specifically monitor whether any of the components they use have known vulnerable components.

          Free tools of this type:

          • OWASP has its own free open source tools:
            • OWASP Dependency Check
            • OWASP Dependency Track
            • A native GitHub feature that reports known vulnerable dependencies in your GitHub projects. Supports: Java, .NET, JavaScript, Ruby, and Python. Your GitHub projects are automatically signed up for this service.
            • Detects known vulnerabilities in source code dependencies,
            • Blocks dependencies based on policies such as vulnerabilities, type of license, release dates and more
            • Identifies, fixes and prevents known vulnerabilities. Read more at https://debricked.com
            • Create a free account

            Commercial tools of this type that are free for open source:

            • Aikido - Combines open source software with custom rules & features into a single dashboard with all your security findings. Includes both Library Analysis and SAST tools. Free for small teams.
            • Bytesafe - Bytesafe Dependency Firewall manages source code dependencies securely
              • Detects Known Vulnerabilities in dependencies
              • Identifies OSS licenses used in dependencies and prevents use of problematic licenses.
              • Provides SCA capabilities such as SBOM creation
              • Free for Open Source Projects and individual users
              • Identifies, fixes and prevents known vulnerabilities through automation without the need to give access to your source code. Read more at https://debricked.com
              • Allows for vulnerability management and license compliance in the same tool
              • Features automated fix pull request to automatically fix vulnerabilities (currently only for javascript)
              • Features one of the most complete vulnerability databases
              • GitHub version: https://github.com/apps/debricked/
              • Complete Software Supply Chain Security Solution, based on Pipeline Bill Of Materials
              • Manage your findings from a single location
                • Full visibility and end to end traceability over your software pipeline security from cloud to code.
                • Manage your findings, orchestrate DevSecOps activities, prevent risks and maintain software pipeline integrity
                • Avoid known security risks like Log4j and Codecov.
                • Prevent new attack types based on proprietary research and threat intel.
                • Ensure the security and integrity of all cloud artifacts
                • Undertake security gap analysis and identify any blind spots.
                • Use with any public GitHub repository
                • C++, Node, Ruby, Python, Java, .Net, and more
                • Integrates with GitHub
                • Connect to Jira, Azure DevOps, or GitHub Issues
                • Robust license policies
                • Rich vulnerability dashboard
                • SBOM generation (SPDX/CycloneDX)
                • A Commercial tool that identifies vulnerable components and integrates with numerous CI/CD pipelines. Free for open source: https://snyk.io/plans
                • If you don’t want to grant Snyk write access to your repo (see it can auto-create pull requests) you can use the Command Line Interface (CLI) instead. See: https://snyk.io/docs/using-snyk. If you do this and want it to be free, you have to configure Snyk so it knows it’s open source: https://support.snyk.io/hc/en-us/articles/360000910597-How-can-I-set-a-Snyk-CLI-project-as-open-source
                  • Another benefit of using the Snyk CLI is that it won’t auto create Pull requests for you (which makes these ‘issues’ more public than you might prefer)
                  • The real time indicator that promotes supply chain transparency Free for FOSS projects: https://software-health-indicator.com/order/
                  • They make their component vulnerability data (for publicly known vulns) free to search: https://www.sourceclear.com/vulnerability-database/search#_ (Very useful when trying to research a particular library)
                  • At Vulert Playground, one can test an app’s security without any sign-ups. Visit Vulert Playground
                  • Free for open source and small companies.
                  • Azure version: https://marketplace.visualstudio.com/items?itemName=whitesource.ws-bolt
                  • GitHub version: https://github.com/marketplace/whitesource-bolt
                  • The platform comes with a freemium plan for unlimited time and users count.The pipelineless security approach is the value the company charges for, so the visibility remains always free.
                  • SBOMs are generated and automatically updated across all source code repositories.
                  • Supported languages: .Net, C, C++, L, Go, Java, JavaScript (including various frameworks), PHP, Python, Ruby, Rust, Scala, Swift.
                  • Simplifies the risk prioritization by automatically classifying the business important of each product and correlating the potential exploitability with open source threat feeds (e.g. EPSS).

                  Code Quality tools

                  Quality has a significant correlation to security. As such, we recommend open source projects also consider using good code quality tools. A few that we are aware of are:

                  • SpotBugs - Open source code quality tool for Java
                    • This is the active fork for FindBugs, so if you use Findbugs, you should switch to this.
                    • SpotBugs users should add the FindSecBugs plugin to their SpotBugs setup, as it significantly improves on the very basic security checking native to SpotBugs.
                    • This is a commercially supported, very popular, free (and commercial) code quality tool. It includes most if not all the FindSecBugs security rules plus lots more for quality, including a free, internet online CI setup to run it against your open source projects. SonarQube supports numerous languages: https://www.sonarqube.org/features/multi-languages/
                    • DeepScan is a static code analysis tool and hosted service for inspecting JavaScript code. It checks possible run-time errors and poor code quality using data-flow analysis and provides results for the project’s code quality.
                    • DeepScan is free for open source projects on GitHub.
                    • MegaLinter is an Open-Source tool that analyzes the consistency of your code, IAC, configuration, and scripts in your repository sources, to ensure all your projects repositories are clean and formatted whatever IDE/toolbox is used by their developers
                    • More than 100 linters supporting 52 languages, 24 formats, 21 tooling formats, spelling and security
                    • Ready to use out of the box, compliant with GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, Concourse, Drone CI, or even locally with mega-linter-runner
                    • Highly configurable, without registration
                    • 100% Open-Source and free for all uses, powered and backed by by OX Security

                    Defense Tools

                    • AWS Firewall Factory - An open source solution that makes it easy to deploy, update, and provision OWASP TOP 10 compliant web application firewalls (WAFs) at scale while centrally managing them with AWS Firewall Manager. This solution streamlines security management by enabling customisation of WAF configurations and adherence to AWS best practices.

                    Security Tools Built into DevOps/CI Environments

                    • GitLab - is building security into their platform and it is quickly evolving as described here.
                      • They are leveraging the best free open source tools they can find and building them into the GitLab CI pipeline to make it easy to enable them. This includes many categories of security tools:
                        • SAST
                        • DAST
                        • Code Quality
                        • Dependency Analysis
                        • Container Scanning
                        • Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your terminal and get your work organized on the run. Faraday was made to let you take advantage of the available tools in the community in a truly multiuser way.
                        • Community Version: public open source projects on GitHub

                        Secrets Detection Tools

                        Secrets detection is often confused with SAST because both scan through static source code. Secrets detection scan the default branch before deployment but can also scan through every single commit of the git history, covering every branch, even development or test ones.

                        • GitGuardian
                          • A commercial tool that scans your Git repositories’ history and monitors new contributions in real-time for secrets. It examines secret exposure trends over time and monitors team performance. Free for open source repositories hosted under your GitHub Organization
                          • Container Scanning ggshield is a command-line interface application to help developers detect and prevent vulnerabilities like hard coded secrets (like API keys, certificates, database connection URLs) before pushing their code to shared repositories. ggshield is integrated with GitGuardian Internal Monitoring, the automated secrets detection and remediation platform. Recently, ggshield has also integrated the capability of scanning Terraform files for infrastructure-as-code for security misconfigurations (public beta).
                          • All code is open-source (gitleaks) or source-available (Gitleaks-Action).
                          • Over 140 secret types with new types being added all the time
                          • A GitHub scanning tool that identifies hardcoded credentials (Passwords, API Keys, Secret Keys, Tokens, personal information, etc.), filtering the false positive data through machine learning models.
                          • Find credentials in repositories (git, GitHub, GitLab), filesystem, S3 buckets, GCS buckets, syslog, CircleCI, Docket Images
                          • Eliminates false positives using 700+ credential detectors that support active verification against their respective APIs
                          • Available as a GitHub Action
                          • detect-secrets is an aptly named module for detecting secrets within a code base. Unlike other similar packages that solely focus on finding secrets, this package is designed with the enterprise client in mind: providing a backwards compatible means to prevent new secrets from entering the code base.
                          • The platform comes with a freemium plan for unlimited time and users count.The pipelineless security approach is the value the company charges for, so the visibility remains always free.
                          • Hardcoded secrets validation and custom regex configuration are built in.
                          • Secrets mitigation is provided with a developer experience focus.

                          Please let us know if you are aware of any other high quality application security tools that are free for open source (or simply add them to this page). We are particularly interested in identifying and listing commercial tools that are free for open source, as they tend to be better and easier to use than open source (free) tools. If you are aware of any missing from this list, please add them, or let us know (dave.wichers (at) owasp.org) and we’ll confirm they are free, and add them for you. Please encourage your favorite commercial tool vendor to make their tool free for open source projects as well!!

                          Finally, please forward this page to the open source projects you rely on and encourage them to use these free tools!

                          The OWASP ® Foundation works to improve the security of software through its community-led open source software projects, hundreds of chapters worldwide, tens of thousands of members, and by hosting local and global conferences.