Security

Trivy34.1k★

Trivy is the Swiss Army knife of security scanning — containers, filesystems, git repos, IaC configs, Kubernetes manifests, and SBOMs, all from one CLI command. Add it to your CI pipeline in two lines and catch vulnerabilities, misconfigurations, and leaked secrets before they ship. Every indie hacker pushing Docker images should run Trivy. It's free, adds 10-30 seconds to your pipeline, and catches real problems. Snyk is the polished commercial alternative with better remediation guidance. Grype is simpler but only scans vulnerabilities (no IaC, no secrets). Docker Scout is built into Docker Desktop but limited. The catch: Trivy's vulnerability database isn't perfect — run it alongside Grype for better coverage, since they use different data sources. False positives happen, especially with OS-level packages in base images. And while Trivy scans broadly, it doesn't prioritize — you'll need to triage the results yourself. It finds problems; it doesn't fix them.

Gitleaks25.5k★

Gitleaks is the fastest way to catch secrets before they hit your repo. A single Go binary that scans Git history, pre-commit hooks, and CI pipelines for API keys, tokens, and credentials. Fast, simple, no account required. If you want a pre-commit hook that blocks you from pushing AWS keys, Gitleaks takes five minutes to set up. TruffleHog is the main alternative — more thorough (it verifies if secrets are live) but slower and AGPL-licensed. GitGuardian is the commercial option with team dashboards. detect-secrets (Yelp) is Python-based and less actively maintained. Best for solo developers and small teams who want secret scanning without complexity. Add it to your pre-commit config and forget about it. It just works. The catch: Gitleaks finds patterns, not verified secrets. You'll get false positives — high-entropy strings that look like keys but aren't. No verification means you're triaging alerts manually. And scanning large repos with deep history can be slow — scope your scans to recent commits in CI.

TruffleHog25.2k★

TruffleHog is your last line of defense against the "I accidentally committed my AWS keys" disaster. It scans Git repos, S3 buckets, Slack, and more for leaked credentials — then actually verifies if those secrets are still live. That verification step is what separates it from grep-with-regex. If you've ever pushed a .env file to GitHub (we all have), you need this in your CI pipeline yesterday. Gitleaks is the main alternative — faster, lighter, great for pre-commit hooks, but it doesn't verify credentials. On the commercial side, GitGuardian offers slick dashboards and team workflows but charges per developer. Best for any team shipping code to public repos. Solo founders should at minimum run it as a pre-commit hook. The scan-and-verify workflow catches real problems, not just pattern matches. The catch: it's AGPL-3.0. If you're building a security SaaS, you can't embed TruffleHog without open-sourcing your code. For internal use, that's fine. For a product, talk to a lawyer.

SOPS21.3k★

SOPS is the secrets tool for teams who think HashiCorp Vault is overkill — and they're usually right. It encrypts YAML, JSON, and ENV files so you can commit secrets directly to Git. No server, no cluster, no unsealing ceremony. Just encrypted files that go through the same PR review as your code. If you're doing GitOps with Flux or ArgoCD, SOPS is the standard. It plugs into AWS KMS, GCP KMS, Azure Key Vault, or age for encryption — pick your backend and go. Vault is the enterprise alternative with dynamic secrets and rotation, but it's a full infrastructure commitment. Infisical is the modern managed option. Sealed Secrets handles Kubernetes specifically. The catch: SOPS is file encryption, not secrets management. No dynamic secrets, no rotation, no access controls, no audit logs. Your app can't fetch secrets at runtime like it can from Vault. And once your team grows past a handful of services, the "encrypted files in Git" model starts showing cracks.

CrowdSec12.9k★

Fail2ban with a hive mind. CrowdSec doesn't just watch your logs — it taps into a global network of threat intelligence, so when one user detects an attacker, every CrowdSec installation can proactively block that IP before the attack arrives. That's a fundamentally different security model than anything Fail2ban offers. Fail2ban is the classic choice — simple, battle-tested, works everywhere. Wazuh is the enterprise-grade SIEM. CrowdSec sits in the sweet spot: more intelligent than Fail2ban, lighter than Wazuh. Written in Go, it's faster and less resource-hungry than Fail2ban's Python stack. It catches advanced attacks — bot scraping, L7 DDoS, credential stuffing — not just SSH brute force. The community blocklists are genuinely useful for small operators who can't afford commercial threat feeds. The catch: the crowd intelligence is CrowdSec's moat, but it's also a dependency. You're trusting community-contributed threat data. False positives in the shared blocklist can block legitimate traffic. And the most advanced features — custom scenarios, enterprise console — are behind the paid tier.

Falco8.8k★

Falco is the runtime threat detection system for containers and Kubernetes. It watches system calls in real-time via eBPF and alerts when something suspicious happens — a shell spawning inside a container, sensitive file access, unexpected network connections. Think of it as a security camera for your containers. If you're running containers in production and need runtime security monitoring, Falco is the CNCF-graduated standard. Tetragon does similar eBPF-based detection with enforcement capabilities. KubeArmor restricts container behaviors using eBPF and Linux Security Modules. Commercially, Sysdig (Falco's creator), Aqua Security, and Crowdstrike offer runtime security with better UIs and management. The rule system is expressive — define what "normal" looks like and alert on deviations. Default rules catch common attacks out of the box. The catch: Falco only detects — it doesn't block. You need additional tools (KubeArmor, network policies) for prevention. Writing custom rules requires understanding Linux syscalls and container internals. False positives are common initially, and tuning rules for your workloads takes time. The eBPF driver requires kernel support, which can be tricky on older or locked-down hosts.

eth-phishing-detect1.3k★

Eth-phishing-detect is MetaMask's open-source blocklist of 205,000+ phishing domains targeting crypto wallets. It's the defensive layer between your users and wallet drainers, seed phrase stealers, and fake swap interfaces. If you're building any Web3 frontend, checking URLs against this list is free insurance. If you're building a dApp browser, wallet, or any Web3 interface that loads external URLs, integrate this blocklist. ChainPatrol is the commercial threat detection service with more sophisticated analysis. PhishFort offers managed phishing response. SEAL (Security Alliance) contributes threat intelligence directly to this list. The catch: a blocklist is reactive, not proactive. New phishing domains appear faster than they get flagged — the gap between a domain going live and appearing on the list is where users get hurt. The list is massive but not exhaustive. And this only covers domain-level detection — it won't catch phishing that happens through legitimate domains via compromised frontends or malicious contract interactions.