Alternatives to DepsHub
Compare DepsHub alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to DepsHub in 2026. Compare features, ratings, user reviews, pricing, and more from DepsHub competitors and alternatives in order to make an informed decision for your business.
-
1
Fugu Cyber
Sakana AI
Fugu Cyber is a specialized multi-agent orchestration model purpose-built for modern cyber defense. It behaves like a single model through one API endpoint, but dynamically coordinates specialized agents to solve complex, multi-step security tasks without depending on one model provider. It focuses on two core defense workflows, analyzing complex codebases to verify real-world vulnerabilities and translating raw cyber threat intelligence into working detection rules. On CyberGym, which evaluates vulnerability analysis and verification, Fugu Cyber achieved an 86.9% success rate; on CTI-REALM, which measures detection-rule generation from threat reports, it reached 72.1%, placing it alongside leading cyber-focused frontier models. Fugu Cyber is intended to work as the reasoning engine inside broader security systems rather than as a standalone solution.Starting Price: $6 per 1M tokens (input) -
2
Dependabot
GitHub
Dependabot is an automated dependency management tool that integrates seamlessly with GitHub repositories to keep project dependencies up-to-date and secure. By regularly scanning for outdated or vulnerable libraries, Dependabot proactively generates pull requests to update these dependencies, ensuring that projects remain secure and compatible with the latest releases. Its core logic is designed to handle various package managers and ecosystems, making it versatile for diverse development environments. Developers can customize Dependabot's behavior through configuration files, allowing for tailored update schedules and specific dependency rules. By automating the dependency update process, Dependabot reduces the manual effort required to maintain project dependencies, thereby enhancing overall code quality and security.Starting Price: Free -
3
JFrog Xray
JFrog
DevSecOps Next Generation – Securing Your Binaries. Identify security vulnerabilities and license violations early in the development process and block builds with security issues from deployment. Automated and continuous governance and auditing of software artifacts and dependencies throughout the software development lifecycle from code to production. Additional functionalities include: - Deep recursive scanning of components drilling down to analyze all artifacts and dependencies and creating a graph of relationships between software components. - On-Prem, Cloud, Hybrid, or Multi-Cloud Solution - Impact analysis of how an issue in one component affects all dependent components with a display chain of impacts in a component dependency graph. - JFrog’s vulnerabilities database, continuously updated with new component vulnerability data, includes VulnDB, the industry’s most comprehensive security vulnerability database. -
4
The Code Registry
The Code Registry
The Code Registry is an AI-powered code intelligence and analysis platform that gives businesses and non-technical stakeholders full visibility into their software codebase, even if they don’t write code themselves. Upon connecting your code repository (GitHub, GitLab, Bitbucket, Azure DevOps, or uploading a zipped archive), the platform creates a secure “IP Vault” and runs a comprehensive automated analysis across your entire codebase. It produces a range of reports and dashboards, including a code-complexity score (revealing how intricate or maintainable your code is), open-source component analysis (detecting dependencies, license status, outdated or vulnerable libraries), security analysis (identifying potential vulnerabilities, insecure configurations or risky dependencies), and a “cost-to-replicate” valuation, estimating how much effort or resources it would take to rebuild or replace the software from scratch.Starting Price: $2 per month -
5
Mend Renovate
Mend.io
Save time and reduce risk by automating dependency updates in software projects. Fully customizable with a setting to suit every workflow. Renovate runs continuously to detect the latest available versions. Multiple languages and file types are supported in order to detect dependencies wherever you use them. Changelogs and commit histories are extracted and included with each update. Run your existing suite of tests on every update to avoid regression errors.Starting Price: Free -
6
CodeDD
CodeDD
CodeDD uses AI to automate technical Due Diligence on software investments. Set to increase security via transparency, it allows self-serviced software stack auditing of own or external code stack. Used by M&A professionals, Investment Managers and in software procurement, it leverages the power of Large Language Models to provide actionable insights, easy and understandable reports and a cost-effective alternative to manual review. Key features: Audit Any Repository: Review entire code stacks with over +40 quality parameters. Review Security Flags: Get detailed reports on security vulnerabilities, with estimated fix times. View Project Dependencies: Gain insights into external dependencies, including licenses and vulnerabilities, backed by a database of over 2 million software packages. File-Level Insights: Dive deep into each file for a comprehensive overview of the entire codebase, without revealing any code.Starting Price: $250 per software audit -
7
Coana
Socket
Traditional SCA tools do not distinguish between exploitable and unexploitable vulnerabilities. As a consequence, up to 95% of the vulnerabilities that developers are remediating 'are irrelevant and can be safely ignored. Coana employs reachability analysis to eliminate up to 95% false positives. As a consequence, developers only need to remediate the remaining few vulnerabilities that are relevant. With up to 95% of vulnerabilities being unreachable, you save time and resources by focusing only on the remaining few that pose a real threat. Pinpoint the exact locations in your code affected by reachable vulnerabilities. See exactly which dependency updates are necessary to remediate reachable vulnerabilities. Identify reachable vulnerabilities in both direct and indirect dependencies.Starting Price: $20 per user per month -
8
Bytesafe
Bitfront
Increase your open source security posture with automated best practices, with a unified workflow for security and developer teams. The cloud-native security platform reduces risk and protects revenue, without slowing down developers. The dependency firewall quarantines malicious open source before reaching developers and infrastructure, protecting data, assets, and company reputation. Our policy engine evaluates threat signals such as known vulnerabilities, license information, and customer-defined rules. Having insight into what open-source components are used in applications is crucial to avoid exploitable vulnerabilities. Software Composition Analysis (SCA) and dashboard reporting give stakeholders a holistic overview with immediate insights into the current situation. Discover when new open-source licenses are introduced in the codebase. Automatically track license compliance issues and restrict problematic or unlicensed packages.Starting Price: €1100 per month -
9
Sonatype Vulnerability Scanner
Sonatype
Sonatype’s Vulnerability Scanner is a tool designed to help developers identify security risks and compliance issues in their open-source components. It provides users with a comprehensive Software Bill of Materials (SBOM), which lists all open-source dependencies and highlights vulnerabilities and license risks. The platform offers real-time scanning and actionable insights, allowing teams to assess the severity of risks and implement fixes swiftly. With automated scans and detailed reports, Sonatype’s Vulnerability Scanner helps organizations secure their applications, manage third-party dependencies, and maintain compliance across their software environments. -
10
Endor Labs
Endor Labs
Simplified dependency lifecycle management lies at the heart of both supply chain security and developer productivity. Endor Labs helps security and dev teams accelerate development by safely maximizing software reuse. Reduce the overall amount of dependencies with a better selection process, and eliminate of unused dependencies. Identify the vulnerabilities that matter, and use dozens of leading indicators of risk to defend against software supply chain attacks. Get out of dependency hell faster by identifying and remediating bugs and security issues in your dependency chain. Increased productivity for dev and security teams. By maximizing software reuse, minimizing false positives, and making it easier for security and development teams to select, secure, and maintain dependencies, Endor Labs helps organizations focus on shipping value-adding code. Get complete visibility into your dependency network across repos. Who is using what, and who depends on who. -
11
Craftifact
SoluForge
Craftifact is a European artifact repository SaaS for software teams that need reliable package distribution together with supply-chain visibility. It provides hosted, proxy, and group repositories for Maven, npm, Python, OCI/Docker, and Go, with browser-based artifact metadata and repository management. CycloneDX SBOMs can be uploaded and, for selected hosted content, generated and linked to artifacts or OCI digests. Teams can inspect dependencies and review vulnerability, license, exposed-secret, and policy signals close to the affected artifact. Access is controlled through OIDC, RBAC, groups, robot accounts, and scoped tokens, with APIs for CI/CD and evidence workflows. Craftifact is operated in Europe by a German company under EU jurisdiction and includes managed updates, monitoring, backups within plan scope, and predictable non-seat-based pricing. It supports CRA-relevant technical preparation but does not replace legal or conformity assessment.Starting Price: €99/month -
12
Mendel
Mendel
Mendel is an AI-powered code intelligence platform designed to automate pull request reviews, flag complexity and compliance issues, and surface team insights. By leveraging agentic AI workflows, Mendel enhances engineering efficiency through features like automated code reviews, real-time performance analytics, intelligent repository and code analysis, and smart dependency and compliance checks. It provides actionable insights from repositories and developer contributions, enabling teams to track performance and resolve bottlenecks effectively. With capabilities such as docstring detection, complexity analysis, and issue classification, Mendel streamlines repository scans. It also automates scans for outdated libraries and vulnerable dependencies, ensuring robust security across the codebase. Mendel's integration with existing Git workflows allows for seamless adoption, delivering context-rich AI reviews instantly.Starting Price: Free -
13
CAST SBOM Manager
CAST
CAST SBOM Manager enables users to automatically create, customize, and maintain Software Bill of Materials (SBOMs) with the ultimate level of control and flexibility. It detects open source dependencies and related risks (vulnerabilities and security advisories, licenses, obsolescence) directly from scanning source code, and allows you to create and maintain SBOM metadata over time (proprietary components, custom licenses, vulnerabilities) and much more.Starting Price: Free -
14
DNF
DOCS
DNF is a software package manager that installs, updates, and removes packages on Fedora and is the successor to YUM (Yellow-Dog Updater Modified). DNF makes it easy to maintain packages by automatically checking for dependencies and determining the actions required to install packages. This method eliminates the need to manually install or update the package, and its dependencies, using the rpm command. DNF is now the default software package management tool in Fedora. Removes packages installed as dependencies that are no longer required by currently installed programs. Checks for updates, but does not download or install the packages. Provides basic information about the package including name, version, release, and description.Starting Price: Free -
15
Moderne
Moderne
Reduce 1000s of hours of static code analysis fixes to minutes. Patch security vulnerabilities across 100s of repositories at once. Moderne automates code remediation tasks for you, enabling developers to deliver more business value all the time. Automatically make safe, sweeping changes to your codebase that improve the quality, security, and cost of code. Manage dependencies of your software supply chain, keeping software up to date continuously. Alleviate code smells automatically without all the scanning noise of SAST and SCA tools. Work in high-quality code all the time. Find and fix CVEs automatically across repositories, it's the ultimate shift left for security. The reality of modern applications is that they naturally accrue technical debt. They are composed of large and diverse codebases and ecosystems, and a supply chain of custom, third-party, and open-source software. -
16
Docusnap
itelio
Docusnap inventories your network infrastructure, hardware, and software as well as common application servers. With Docusnap, you can easily create network maps and evaluation reports as well as operation manuals and contingency plans. Docusnap shows you who has access to which data and if your software is correctly licensed. You can also identify existing IT dependencies. Docusnap captures information of the network infrastructure, hardware and software as well as common application servers. Let Docusnap generate reports and maps of your network. Create contingency plans and operation manuals. Learn who has access to which data and whether your software is licensed correctly. Identify IT dependencies. At itelio, the focus is on the team! The company’s success is fueled by our highly skilled and motivated employees. By now, itelio GmbH has been able to secure the skills of about 90 experts from various nations. -
17
Sonatype Repository Firewall
Sonatype
Sonatype Repository Firewall is a security solution that provides proactive protection for your software supply chain by intercepting malicious open-source components before they enter your development process. Utilizing AI-powered behavioral analysis, it detects and prevents known and unknown vulnerabilities across dependencies. The platform offers real-time policy enforcement, allowing users to set customizable policies based on risk levels, such as the age or popularity of open-source components. With automated vulnerability prevention, Sonatype Repository Firewall helps businesses maintain compliance, enhance security, and reduce risk, while boosting developer productivity by avoiding unnecessary disruptions. -
18
Xygeni
Xygeni Security
Xygeni All-In-One AppSec Platform protects software from code to cloud with a unified solution built for Application Security Posture Management (ASPM). It gives CISOs, CIOs, and DevSecOps teams full visibility and control across the software supply chain, without slowing delivery. Xygeni secures every SDLC stage, code, dependencies, secrets, builds, IaC, containers, and CI/CD systems, detecting vulnerabilities, misconfigurations, and malware in real time. Powered by advanced AI, Xygeni prioritizes exploitable risks, cuts 90% of alert noise, and drives automated remediation through AI SAST, Auto-Fix, and Xygeni Bot. Developers scan and fix issues directly in their IDE, keeping code secure from the start. Early Malware Warning blocks zero-day supply-chain threats at publication, while smart dependency analysis prevents breaking updates. Seamless integration with GitHub, GitLab, Bitbucket, Jenkins, and Azure DevOps ensures a frictionless experience. -
19
ThreatMapper
Deepfence
Open source, multi-cloud platform for scanning, mapping, and ranking vulnerabilities in running containers, images, hosts, and repositories. ThreatMapper discovers the threats to your applications in production, across clouds, Kubernetes, serverless, and more. What you cannot see, you cannot secure. ThreatMapper auto-discovers your production infrastructure. It identifies and interrogates cloud instances, Kubernetes nodes, and serverless resources, discovering the applications and containers and mapping their topology in real-time. Use ThreatMapper to discover and visualize the external and internal attack surface for your applications and infrastructure. Exploiting known vulnerabilities in common dependencies is one of the easiest ways for bad actors to gain a foothold within your infrastructure. ThreatMapper scans hosts, containers, and applications for known vulnerable dependencies, taking threat feeds from over 50 different sources. -
20
Aptitude
Debian
Aptitude is an Ncurses and command-line based front-end to numerous Apt libraries, which are also used by Apt, the default Debian package manager. Aptitude is text-based and run from a terminal. A mutt-like syntax for matching packages in a flexible manner. Mark packages as "automatically installed" or "manually installed" so that packages can be auto-removed when no longer required (feature available in Apt, too, since quite a few Debian releases). Preview of actions about to be taken with different colors marking different actions. The ability to interactively retrieve and display the Debian changelog of all available official packages. Score-based dependency resolver which is more suitable for interactive dependency resolution with additional hints from the user like "I don't want that part of the solution but keep that other part of the solution for your next try". Apt's dependency resolver on the other hand is optimized for good "one-shot" solutions.Starting Price: Free -
21
Mbed Studio
Mbed Studio
Mbed Studio is a free IDE for Mbed OS application and library development, including all the dependencies and tools you need in a single package so that you can create, compile and debug your Mbed programs on the desktop. Develop your applications using Mbed OS, switching between pre-defined build profiles for development, debug or release. With API auto-completion, you'll find code authoring easier, likewise you can inspect hardware-dependent settings such as pin mappings based on your selected platform. As new features, code size improvements and fixes are added to Mbed OS in each release, your application can benefit from them, with Mbed Studio notifying you of available updates. Likewise, other drivers and libraries, such as those available on mbed.com can be updated. Develop IoT products that can be managed throughout their lifecycle. Mbed accounts allow you to access the free tier of pelion device management services, allowing you to connect and manage up to 100 devices. -
22
Root
Root
Root is a secure supply platform that delivers autonomous vulnerability remediation for container images and application dependencies, enabling organizations to eliminate security risks without disrupting existing workflows. Unlike traditional security tools that only detect or prioritize vulnerabilities, Root automatically fixes them in place, continuously patching CVEs across the versions teams already run. It integrates directly into current development pipelines and infrastructure, allowing companies to secure their software stack without rebuilding containers, forcing upgrades, or migrating registries. Powered by an automated remediation system, Root discovers the images and libraries in use, applies targeted fixes, and delivers secured artifacts ready for deployment while maintaining compatibility. Its Root Image Catalog provides continuously remediated container images, while the Root Library Catalog patches open source dependencies. -
23
Visual Expert
Novalys
Visual Expert is a static code analyzer for Oracle PL/SQL, SQL Server T-SQL, and PowerBuilder. Identify code dependencies to modify your code without breaking your application. Scan your code to improve the security, performance, and quality. Perform Impact analysis to Identify breaking changes. Automatically scan your code to detect and fix security vulnerabilities, bugs and maintenance Issues. Implement continuous code inspection Understand the inner workings of your code with call graphs, code diagrams, CRUD Matrix and Object Dependency Matrix (ODM). Automatically generate an HTML Source Code documentation. Explore your code exploration with hyperlinks Compare applications, databases or pieces of code. Improve maintainability. Clean up code. Comply with dev standards. Analyze and Improve DB code performance: Find slow objects and SQL queries, Optimize a slow object, a Chain of calls a slow SQL, Get a query Execution Plan. And much more.Starting Price: $495 per year -
24
Apache Ivy
Apache Software Foundation
Apache Ivy™ is a popular dependency manager focusing on flexibility and simplicity. Find out more about its unique enterprise features, what people say about it, and how it can improve your build system! Ivy is a tool for managing (recording, tracking, resolving, and reporting) project dependencies. Ivy is essentially process agnostic and is not tied to any methodology or structure. Instead, it provides the necessary flexibility and reconfigurability to be adapted to a broad range of dependency management and build processes. While available as a standalone tool, Ivy works particularly well with Apache Ant providing a number of powerful Ant tasks ranging from dependency resolution to dependency reporting and publication. Ivy has a lot of powerful features, the most popular and useful being its flexibility, integration with Ant, and strong transitive dependencies management engine. Ivy is open source and released under a very permissive Apache License.Starting Price: Free -
25
PRFlow
PRFlow
PRFlow is an AI code reviewer built to find the bugs that ship. It indexes your codebase, traces cross-file dependencies, and produces a structured security review in under 3 minutes, automatically on every pull request. Built for the complexity of real codebases, PRFlow uses semantic codebase memory to understand cross-repo dependencies and internal patterns before reading the PR. It extracts the right context for the LLM, including the changed function and its cross-file dependencies, instead of sending only the diff or the whole file. Its security-first review focuses on issues like XSS, SSRF, SQL injection, auth bypass, and race conditions by tracing how code flows across files. PRFlow reads the whole PR once and produces a complete structured review with a score, walkthrough, issues by file, severity, strengths, and code fix suggestions directly as inline GitHub PR comments. It supports conversational follow-up inside the PR thread.Starting Price: Free -
26
Arctic Data Canadian Payroll
Arctic Data Canadian Payroll
Arctic Data Corporation has been supplying Canadian businesses with payroll software since 1982. The Canadian Payroll Software, designed for WINDOWS XP/Vista/7/8/10, can be integrated with Arctic Data's Multi-user accounting system or used in a stand-alone environment. With the ability to print cheques, do direct bank deposits, generate T4s and Record of Employement (ROEs) ADC's Canadian Payroll system will help streamline your small or medium size business payroll. The system can handle up to 99 separate companies. The costs for payroll updates are $99.95 per update. The government releases tax changes for January 1 every year. On occasion, an additional update is released for July 1. Depending upon the changes you may wish to purchase the update if it affects your employees. The system will allow up to 32,000 employees per payroll company or dependant upon disk space. The system has the ability to create customer reports from the data you have entered into the system.Starting Price: $99.95 one-time payment -
27
Versionveil
Synov8 Ltd
Versionveil is a realtime vendor change intelligence platform for engineering teams. It monitors vendors like OpenAI, Stripe, Vercel, Supabase, Anthropic, and Cloudflare, tracking API, pricing, SDK, and infrastructure changes that are usually scattered across changelogs, docs, and status pages. Versionveil turns these updates into structured alerts with severity, clear summaries, and AI-generated impact analysis explaining what changed and why it matters. Alerts are routed to Slack, Discord, or email, so the right teams see the right changes fast. Everything is also stored in a searchable history of vendor changes. It helps teams reduce dependency risk and avoid production surprises from third-party changes. -
28
Dependency Track SaaS
YourSky.blue
Dependency Track SaaS provided by YourSky.blue is the managed cloud solution of the popular open-source Dependency-Track. Always up to date with the latest security bulletins, it allows to easily monitor all the chain of software components through powerful dashboards and configurable alerts. It periodically scans already uploaded SBOMs for new security issues, outdated versions or licenses at risk. YourSky.blue Dependency Track SaaS is one of the most powerful and essential tool to manage software assets conveniently. The SaaS product also includes Single-Sign-On technology to facilitate integration with any enterprise identity provider.Starting Price: USD 10.08 per user per month -
29
MyGet
MyGet
The Secure Universal Package Manager. Continuously govern and audit all packages in your DevOps lifecycle. Thousands of teams worldwide trust MyGet with their package management and governance. Accelerate your software team with cloud package management, robust security controls and easy continuous integration build services. MyGet is a Universal Package Manager that integrates with your existing source code ecosystem and enables end-to-end package management. Centralized package management delivers consistency and governance to your DevOps workflow. MyGet real-time software license detection tracks your teams’ package usage and detects dependencies across all of your packages. Customized usage policies ensure your teams are only using approved packages while reporting vulnerabilities and outdated packages early in your software build and release cycles.Starting Price: $15 per month -
30
Simple Malware Protector
Simplestar Software
Simple Malware Protector identifies threats and vulnerabilities on your PC and will neutralize them quickly and easily. It then constantly monitors your PC to ensure you’re protected against future infection. Simple Malware Protector is continuously updated to ensure you’re protected against the latest threats and vulnerabilities. You can schedule Simple Malware Protector to run at startup or any other time of day, ensuring you are in control of your protection. You can also choose a quick, deep, or custom scan depending on your needs and preferences. Simple Malware Protector will scan your PC and identify security threats and vulnerabilities. Simple Malware Protector can quickly and safely remove these threats and prevent them from reoccurring. Protect your computer from malware, spyware, and other security threats. Restore optimum security to your PC.Starting Price: $3.03 per month -
31
Red Sift ASM
Red Sift
Red Sift ASM (formerly Hardenize) provides a managed service that combines automated internet asset discovery with continuous network and security monitoring. Internet Asset Discovery Multiple sources of information feeds our custom search engine to help you find your websites. Background searches find new properties that belong to you and automatically add them to your inventory. Host and Network Monitoring We continuously monitor your entire network perimeter with fresh data updated daily. We combine scanning of domains, hostnames, and IP addresses. Certificate Inventory and Expiration Monitoring We monitor your certificates and notify if they're about to expire. Crucially, we also monitor the certificates of third-party services, helping you avoid problems via dependencies and services you don't control directly. -
32
Sonatype Lifecycle
Sonatype
Sonatype Lifecycle is a leading software composition analysis (SCA) platform designed to secure applications by automating dependency management and vulnerability monitoring. It provides real-time alerts and in-depth analytics to help developers identify and fix security risks across the software development lifecycle (SDLC). With features like automated patching, customizable policies, and SBOM (Software Bill of Materials) management, Sonatype helps businesses integrate secure open-source components without compromising speed. The platform enhances DevOps workflows by offering insights into dependencies, minimizing risks, and ensuring compliance, all while speeding up development. -
33
Windows Package Manager (winget)
Windows Package Manager
If you are new to the Windows Package Manager, you might want to Explore the Windows Package Manager tool. The packages available to the client are in the Windows Package Manager Community Repository. The client requires Windows 10 1809 (build 17763) or later at this time. Windows Server 2019 is not supported as the Microsoft Store is not available nor are updated dependencies. It may be possible to install on Windows Server 2022, this should be considered experimental (not supported), and requires dependencies to be manually installed as well.Starting Price: Free -
34
ActiveState
ActiveState
ActiveState provides software development teams with the world's most comprehensive library of secure and trusted open source, over 79 million vetted components across all major language ecosystems (e.g., Java, Javascript, Python, R, Go, etc.), including transitive dependencies and OS-level libraries. By building everything from source, we ensure that every component is what it says it is, contains the fewest amount of vulnerabilities, and is continuously remediated. Companies can consume this open source where and when they need it - through their existing artifact repositories, as container images or managed distributions, or via IDPs. When teams transfer their open source responsibility to ActiveState, developers and security teams break free from the endless cycle of vulnerability management. Developers gain confidence knowing their code will make it to production faster and with less friction. Security gains assurance that policy and compliance standards are met by default. -
35
Scuba Database Vulnerability Scanner. Download Scuba, a free tool that uncovers hidden security risks. Scan enterprise databases for vulnerabilities and misconfiguration. Know the risks to your databases. Get recommendations on how to mitigate identified issues. Available for Windows, Mac, Linux (x32), and Linux (x64), Scuba offers over 2,300 assessment tests for Oracle, Microsoft SQL, SAP Sybase, IBM DB2 and MySQL. Scuba is a free tool that scans leading enterprise databases for security vulnerabilities and configuration flaws, including patch levels, that allows you to uncover potential database security risks. It includes more than 2,300 assessment tests for Oracle, Microsoft SQL Server, SAP Sybase, IBM DB2 and MySQL. It’s possible to run a Scuba scan from any Windows, Mac or Linux client. Depending on your database size, users, groups and network connection, an average Scuba scan normally takes 2-3 minutes. No pre-installation or other dependencies are required.
-
36
Ostorlab
Ostorlab
Uncover your organization's vulnerabilities with ease using Ostorlab. It goes beyond subdomain enumeration, accessing mobile stores, public registries, crawling targets, and analytics to provide a comprehensive view of your external posture. With a few clicks, gain valuable insights to strengthen security and protect against potential threats. From insecure injection and outdated dependencies to hardcoded secrets and weak cryptography, Ostorlab automates security assessments and identifies privacy issues. Ostorlab empowers security and developer teams to analyze and remediate vulnerabilities efficiently. Experience hands-off security with Ostorlab's continuous scanning feature. Automatically trigger scans on new releases, saving you time and effort while ensuring continuous protection. Access intercepted traffic, file system, function invocation, and decompiled source code with ease using Ostorlab. See what attackers see and save hours of manual tooling and grouping of outputs.Starting Price: $365 per month -
37
Sonatype Nexus Repository
Sonatype
Sonatype Nexus Repository is a robust binary repository manager designed to store, manage, and distribute open-source components, dependencies, and artifacts across the software development lifecycle (SDLC). It supports over 20 formats, including Maven, npm, PyPI, and Docker, allowing for seamless integration with build tools and CI/CD pipelines. With advanced features like high availability, disaster recovery, and scalability across cloud platforms, Nexus Repository ensures secure and efficient management of your software artifacts. The platform enhances collaboration, automates workflows, and improves visibility into your software supply chain, helping teams manage dependencies and improve software quality. -
38
Supermodel
Supermodel
Supermodel is a developer-focused platform that provides graph-powered tools and APIs to help AI agents and engineers better understand complex codebases, improving the quality and accuracy of AI-generated outputs. At its core is the CodeGraph API, which builds structured representations of software systems, such as dependency graphs, call graphs, and architectural maps, allowing both humans and AI models to navigate and reason about large codebases more effectively. It enables deep codebase analysis by extracting relationships between files, functions, and modules, giving instant visibility into how systems are structured and how components interact. It supports use cases like generating architecture documentation, browsing repository structure, and visualizing dependencies, helping developers quickly understand unfamiliar projects or large-scale systems.Starting Price: $19 per month -
39
SiteLock
SiteLock
We secure websites by automatically finding and fixing threats. Automatically protect your website, reputation, and visitors against cyberthreats. Comprehensive website security software protects your website from malicious cyber threats. This includes the protection of your site code and web applications. Depending on your website security package, you’ll receive daily website scans, automated malware removal, and vulnerability/CMS patching, as well as a web application firewall to block harmful traffic before it ever reaches your site. Our website security scan instantly checks your website from malware, viruses and other cyber threats and alerts you to found issues. Detect and automatically remove malicious content from your website, creating a safe experience for your customers. Easily check for website vulnerabilities in your CMS with our vulnerability scanner before they are exploited. -
40
depthfirst
depthfirst
depthfirst is an AI-native application security platform designed to help organizations detect, prioritize, and fix software vulnerabilities by deeply understanding their code, infrastructure, and business logic as a unified system. depthfirst, built around its core “General Security Intelligence,” analyzes entire repositories and environments to map how systems actually function, enabling it to uncover complex, real-world vulnerabilities that traditional scanners often miss. It evaluates full attack paths, permissions, and data flows to determine whether an issue is truly exploitable, significantly reducing false positives and allowing teams to focus only on meaningful risks. depthfirst operates across multiple layers of the stack, including source code, dependencies, secrets, containers, and running applications, providing continuous security coverage from development through production. -
41
VulnDB
VulnDB
Risk-based security publishes vulnerability intelligence reports that provide a quick view into vulnerability trends, using charts and graphs to summarize the most recently reported vulnerabilities. VulnDB is the most comprehensive and timely vulnerability intelligence available and provides actionable information about the latest in security vulnerabilities via an easy-to-use SaaS portal, or a RESTful API that allows easy integration into GRC tools and ticketing systems. VulnDB allows organizations to search and be alerted on the latest vulnerabilities, both in end-user software and the 3rd party libraries or dependencies. A subscription to VulnDB provides organizations with simple to understand ratings and metrics on their vendors and products, and how each contributes to the organization’s risk-profile and cost of ownership. Vulnerability source information, extensive references, links to proof of concept code, and solutions. -
42
Patchifi
Patchifi
Patchifi is a cloud-native autonomous endpoint management platform that automates patching, compliance, and software deployment to secure and maintain endpoint health for IT teams and MSPs without manual scripting, WSUS dependency, or complex infrastructure. It continuously scans endpoints to detect missing updates and deploys patches automatically with policy-driven automation, helping organizations close vulnerability gaps quickly, maintain real-time compliance, and minimize operational disruptions. It provides centralized dashboards with real-time visibility into patch status, system health, and compliance metrics, and generates audit-ready reporting to simplify regulatory assessments. Patchifi supports automated software deployment and configuration enforcement across hybrid workforces, enabling silent application installs, targeted rollouts, and consistent policy application regardless of network location.Starting Price: $3/month/device -
43
Bazel
Bazel
Bazel is an open-source build and test tool designed for multi-language, multi-platform software projects that delivers fast, incremental builds by rebuilding only what’s necessary and leveraging advanced local and remote caching, optimized dependency analysis, and parallel execution. It natively supports Java, C++, Go, Android, iOS, and many other languages, scaling seamlessly from small repositories to massive monorepos and complex Continuous Integration environments. Its declarative extension language lets teams add or customize rules for new languages and platforms, tapping into a growing community ecosystem. Bazel offers query capabilities to inspect and understand dependency graphs, comprehensive versioned documentation and release notes, and robust support via GitHub, Slack, and monthly community updates. Trusted by industry leaders like Google, Stripe, and Dropbox to build heavy-duty, mission-critical infrastructure and applications.Starting Price: Free -
44
Code Fundi
Code Fundi
Code Fundi is a codebase intelligence platform that powers AI agents, engineering teams, and applications with a searchable map of software repositories. Instead of relying on grep, raw embeddings, or disconnected documentation, it ingests a repository from a URL or GitHub, maps files, functions, dependencies, and logic flows, removes boilerplate noise, and converts the result into a token-optimized representation ready for AI context windows. Its Blast-Radius Guard shows which files, services, and downstream behaviors may be affected before an agent changes code, helping teams prevent silent regressions and production failures. Universal Search runs sub-second semantic queries across one repository or hundreds of codebases, allowing users to find implementation patterns, compare architectures, inspect authentication or testing strategies, and trace how code works across projects.Starting Price: $21 per month -
45
ReadyAPI
SmartBear
The ReadyAPI platform accelerates functional, security, and load testing of RESTful, SOAP, GraphQL and other web services right inside your CI/CD pipeline. ReadyAPI allows teams to create, manage, and execute automated functional, security, and performance tests in one centralized interface - accelerating API quality for Agile and DevOps software teams. Teams can get started by importing API definitions like OAS (Swagger) or WSDLs, testing and recording live API traffic, or virtualizing web services to remove pipeline dependencies. Create comprehensive, data-driven functional API tests without the hassle of maintaining scripts. Generate load, stress, and spike tests to validate whether your API can handle real-world traffic conditions. Secure your vulnerable APIs from XSS, malformed XML, SQL injections and more with each deployment. Remove dependencies in your testing pipeline by virtualizing RESTful, SOAP, TCP, JMS, and other web services.Starting Price: $644 per year -
46
Softagram
Softagram
Software projects tend to be complex and there is the law of entropy making it more complex all the time. The developers easily get lost in the dependency network and tend to create designs that does not stand time well. Softagram provides automatically illustrations on how the dependencies are changing. Automated integration works so that pull requsts (in GitHub, Bitbucket, Azure DevOps), merge requests (in GitLab) and patch sets (in Gerrit) are decorated with a dependency analysis report that pops up as a comment in the tool you already use. The analysis also covers other aspects such as open source licenses and quality. It can be tailored for your needs. Software audits can also be efficiently performed by using Softagram analysis together with Softagram Desktop app designed for advanced software understanding and auditing usage.Starting Price: $25 per month per user -
47
GitHub Advanced Security for Azure DevOps is an application security testing service that is native to the developer workflow. It empowers Developer, Security, and Operations (DevSecOps) teams to prioritize innovation and enhance developer security without sacrificing productivity. Detect and prevent secret leaks from your application development processes with secret scanning. Take advantage of a partner program of more than 100 service providers and scanning for more than 200 token types. Adopt secret scanning quickly and easily without the need for additional tooling via the Azure DevOps UI. Protect your software supply chain by identifying any vulnerable open source components you may be using with dependency scanning. Get straightforward guidance on how to update component references so you can fix issues in minutes.Starting Price: $2 per GiB
-
48
Qbilon
Qbilon
Qbilon is an Enterprise Architecture and IT Landscape Intelligence platform that automatically discovers, maps, and visualizes complex IT environments. It creates a continuously updated inventory of applications, servers, services, and their dependencies, giving organizations complete visibility into their IT landscape. By integrating data from cloud, infrastructure, monitoring, and security systems, Qbilon helps Enterprise Architecture, IT Operations, and CMDB teams maintain accurate IT data without manual documentation. Automated dependency mapping provides a clear understanding of how applications, infrastructure, and business services are connected. Qbilon supports use cases such as CMDB population, cloud transformation, IT modernization, and technology risk management. With integrations including AWS, Microsoft Azure, Google Cloud Platform (GCP), VMware, Darktrace, PRTG, and ServiceNow, organizations can make better decisions based on reliable, real-time information.Starting Price: €203 -
49
Artifact Registry is Google Cloud’s unified, fully managed package and container registry designed for high-performance artifact storage and dependency management. It centralizes hosting of container images (Docker/OCI), Helm charts, language packages (Java/Maven, Node.js/npm, Python), and OS packages, offering fast, scalable, reliable, and secure handling with built-in vulnerability scanning and IAM-based access control. Integrated seamlessly with Google Cloud CI/CD tools like Cloud Build, Cloud Run, GKE, Compute Engine, and App Engine, it supports regional and virtual repositories with granular security via VPC Service Controls and customer-managed encryption keys. Developers benefit from standardized Docker Registry API support, comprehensive REST/RPC interfaces, and migration paths from Container Registry. Daily updated documentation includes quickstarts, repository management, access configuration, observability tools, and deep-dive guides.
-
50
Socket
Socket
Secure your supply chain. Ship with confidence. Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript and Python dependencies. Find and compare millions of open source packages. Socket is not a traditional vulnerability scanner. Socket proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection. Prevent compromised or hijacked packages from infiltrating your supply chain by monitoring changes to package.json and more in real-time. Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.Starting Price: $8 per user per month