Open Source Vulnerability Scanners: 13 Free Tools by Category (2026)

An open source vulnerability scanner is a free tool you can run yourself to find security problems in your code, your dependencies, your containers, your web app or your network. The catch is that "vulnerability scanner" covers very different tools. A scanner that reads Python source has nothing in common with one that probes open ports, and picking the wrong category is the most common mistake teams make.

This guide organizes 13 well-known free scanners by what they actually scan. For each one we checked the license in its official repository, because "free" and "open source" are not the same thing, and a couple of popular tools come with conditions you should know about before you put them in CI.

Summary table: free vulnerability scanners by category

If you are not sure which layer you need first, read SAST vs DAST. The short version: scan code and dependencies on every pull request, and test the running app and network on a schedule.

1. SAST: scanners that read your source code

Static application security testing looks at code without running it and flags data flows from user input to dangerous sinks: SQL queries, shell commands, templates, file paths.

Semgrep Community Edition

Semgrep CE is a lightweight static analysis engine for many languages. Its big advantage is that rules look like the code they match, so writing a custom rule for your own framework takes minutes. The engine is licensed LGPL-2.1. Be aware that the rules in the Semgrep Registry are published under a separate Semgrep Rules License v1.0, which is not the same as the engine license. Opengrep is a community fork of the engine, also under LGPL-2.1.

    semgrep scan --config auto

CodeQL

CodeQL, from GitHub, treats code as a database you query. It is powerful for tracing data flow across files. The licensing is the part people get wrong: the queries and libraries repository is MIT, but the CodeQL CLI is governed by the GitHub CodeQL Terms. Those terms allow free use for academic research and on open source codebases (released under an OSI-approved license). Scanning private, closed-source code requires a paid GitHub license (GitHub Advanced Security or Code Security).

Bandit

Bandit, maintained by PyCQA under Apache-2.0, finds common security issues in Python code: use of eval, pickle, subprocess with shell=True, weak hashing, hardcoded passwords and similar.

    bandit -r src/

Brakeman

Brakeman is a static analysis scanner built specifically for Ruby on Rails, so it understands Rails conventions like controllers, params and ActiveRecord queries. It is distributed under the Brakeman Public Use License: it is free to use, but commercial uses as defined in the license require a commercial license, so it is source-available rather than OSI open source. Read the license before adding it to a commercial pipeline.

2. SCA: dependencies and containers

Most of the code you ship was written by someone else. Software composition analysis matches the versions in your lockfiles and images against vulnerability databases. It is also how you produce an SBOM.

OSV-Scanner

OSV-Scanner is Google's Apache-2.0 scanner that reads lockfiles and manifests and checks them against the open osv.dev database, which aggregates advisories from many ecosystems.

    osv-scanner scan source -r ./

Trivy

Trivy, from Aqua Security under Apache-2.0, is the Swiss army knife of the list. It finds vulnerabilities, misconfigurations and secrets, and generates SBOMs, across container images, Kubernetes, code repositories and cloud environments. If you only install one scanner for infrastructure, this is a common choice.

    trivy fs .
trivy image myapp:latest
trivy config ./infra

Grype

Grype, from Anchore under Apache-2.0, is a vulnerability scanner for container images and filesystems. It pairs naturally with Syft, Anchore's SBOM generator, if you want to separate inventory from matching.

    grype dir:.
grype myapp:latest

3. Secrets: keys and tokens in git

A secret committed once and deleted later still lives in git history. Secret scanners look at the full history, not just the current files. We compare them in depth in secret scanning tools.

Gitleaks

Gitleaks (MIT) scans git repositories, directories and files for secrets using regex and entropy rules. It is fast and easy to run as a pre-commit hook or CI step.

    gitleaks git -v

TruffleHog

TruffleHog (AGPL-3.0) finds, verifies and analyzes leaked credentials. Its distinguishing feature is verification: it can check whether a detected key is still live, which helps you prioritize. Note that AGPL-3.0 has obligations if you modify it and offer it as a network service.

    trufflehog git file://. --results=verified

4. DAST: testing the running web app

Dynamic scanners do not need your code. They send requests to a deployed application and inspect responses, which catches configuration and runtime issues that SAST cannot see.

ZAP

ZAP, now branded "ZAP by Checkmarx" and licensed Apache-2.0, is the best-known free DAST tool. It crawls web apps, runs passive and active scans, and can be scripted in CI with its baseline and full scan modes. Authenticated scanning works but takes real effort to configure.

Nuclei

Nuclei, by ProjectDiscovery under MIT, runs YAML templates against targets. Templates describe a request and what a vulnerable response looks like, and they cover applications, APIs, networks, DNS and cloud configurations. It is excellent for checking known CVEs and exposures across many hosts quickly.

    nuclei -u https://staging.example.com

5. Network and infrastructure

Nmap

Nmap discovers hosts, open ports and running services, and its scripting engine (NSE) adds checks on top. It is distributed under the Nmap Public Source License (NPSL), which is based on open source terms but adds conditions for companies that embed it in commercial products.

    nmap -sV scanme.nmap.org

OpenVAS / Greenbone Community Edition

OpenVAS is the scanner component (GPL-2.0) of Greenbone Community Edition, a full network vulnerability management stack that also includes the gvmd manager (AGPL-3.0) and a feed of vulnerability tests. It scans hosts and services for known vulnerabilities and misconfigurations. Expect a heavier setup than the other tools here.

How to combine them into a free scanning stack

1. On every pull request: Semgrep CE (or Bandit / Brakeman for your stack), OSV-Scanner or Trivy for dependencies, Gitleaks for new secrets.
2. On every image build: Trivy or Grype against the container image, Trivy config against Dockerfiles, Terraform and Kubernetes manifests.
3. Once, on the full history: TruffleHog or Gitleaks against all commits, then rotate anything live.
4. Weekly against staging: ZAP baseline scan and Nuclei templates.
5. For infrastructure you run yourself: Nmap and OpenVAS on your public IP ranges.

For more tooling beyond scanners, see our overview of penetration testing tools.

The limits of free scanners

Open source scanners are excellent, and every team should run some of them. But be honest about what they do not do:

• Noise. Pattern rules and version matching report many findings that are not reachable or not exploitable. Someone has to triage them, and developers stop reading tools that cry wolf.
• No business logic. The most damaging web bugs are often authorization flaws like IDOR, part of broken access control at the top of the OWASP Top 10. "User A can read user B's invoice" is not a pattern any rule matches.
• No fix. Most tools tell you what is wrong, not how to change your code, and none of them opens a tested patch.
• Integration effort. Five tools means five configs, five output formats, five sets of ignore files and nobody owning the combined picture.

This is where reasoning-based analysis helps. AI SAST reads code the way a reviewer does, so it can notice that one handler checks ownership and its sibling does not. Nurbak is built for this: you connect GitHub and scan a repo, its own self-hosted AI model analyzes the code (the analysis does not send your code to OpenAI or Anthropic), and it reports exploitable vulnerabilities with file and line, dependency CVEs, GitHub Actions, Docker, Terraform and Kubernetes misconfigurations and secrets in git history, all summarized in a 0 to 100 score with plain-language explanations. It can open a Pull Request with the fix plus a security regression test (the fix uses Claude, with your explicit consent). The free scan shows the three most important findings in full. You can try it from the vulnerability scanner page.

Scanners vs audits vs pentests

Scanners, a code security audit and a pentest answer different questions. Scanners answer "do we have known bad patterns or versions?" on every commit. A white-box penetration test answers "can someone who reads our code break in?" A human pentest answers "what can a creative attacker chain together?" If you are hiring for the last one, our guide to choosing a penetration testing company covers what to ask, and our pentest report template shows what a good deliverable looks like.

Bottom line

Start with the free tools that match your stack: one SAST engine, one dependency and container scanner, one secret scanner. Add ZAP or Nuclei when you have a staging environment worth testing, and Nmap or OpenVAS if you run your own servers. Check the license of each one before it goes into a commercial pipeline, especially CodeQL, Brakeman and TruffleHog. Then cover the gap that pattern-based tools leave, authorization and business logic, with reasoning-based review or a vulnerability scanner that understands your code.

Related reading

• Secret scanning tools compared
• SAST vs DAST
• What is an SBOM
• Pentest report template
• Secret scanner