Open-source Checkmarx alternatives

Trivy is a security scanner from Aquasec, written in Go and released under the Apache-2.0 license. It has scanners that look for different security issues and targets where those issues can be found. The README describes it as comprehensive and versatile, and it covers the major programming languages, operating systems and platforms.

Targets include container images, filesystems, remote Git repositories, virtual machine images and Kubernetes. Scanners look for OS packages and software dependencies in use, which produces an SBOM, known vulnerabilities (CVEs), infrastructure-as-code issues and misconfigurations, sensitive information and secrets, and software licenses. Its topics reference DevSecOps and vulnerability scanning.

Trivy is available through most common channels, including Homebrew, a Docker image and downloadable binaries, and integrates with platforms such as GitHub Actions, a Kubernetes operator and a VS Code plugin. Canary builds are produced with each push to the main branch. It suits developers, platform teams and security engineers who want to scan images and code in CI pipelines.

Semgrep is a lightweight static analysis tool that searches code, finds bugs and enforces secure guardrails and coding standards. It supports more than 30 languages and can run in an IDE, as a pre-commit check or inside CI/CD workflows. The core engine is released under the LGPL-2.1 license.

It works like a semantic grep for code. Rules are written to look like the source code developers already write, so matching a pattern does not require abstract syntax trees, regular expressions or a separate query language, and a search for a value can match code that computes it. The aim is to find variants of a known bug quickly.

The Community Edition analyzes code within a single function or file, which the maintainers note means it will miss many true positives for security work. For SAST, software composition analysis and secrets scanning they recommend the commercial Semgrep AppSec Platform, which adds cross-file and data-flow analysis, AI-assisted triage and managed rule sets.

Grype is an open-source vulnerability scanner for container images and filesystems. You point it at an image, a directory or a software bill of materials (SBOM), and it reports known vulnerabilities in the packages it finds, so teams can catch risky dependencies before software ships.

It covers major operating system package ecosystems such as Alpine, Debian, Ubuntu, RHEL, Oracle Linux and Amazon Linux, as well as language packages for Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust. Docker, OCI and Singularity image formats are supported. Results can be prioritized with EPSS, KEV and risk scoring, and OpenVEX documents can filter or augment findings.

Grype is written in Go and released under the Apache-2.0 license. It can be installed through Homebrew, Docker, Chocolatey, MacPorts and other routes, and the documentation includes a getting started guide, CLI reference and configuration reference. Development is sponsored by Anchore, which also handles commercial support requests for Grype and its companion tool Syft.

SonarQube is a code quality and security platform. Its static analysis uses techniques such as symbolic execution and data and control flow analysis to inspect source code, find bugs and vulnerabilities, and explain what to fix and why. Results appear in the IDE, in pull requests and in CI pipelines.

This repository holds the source of the SonarQube Community Build, the free, open-source edition that shares the analysis used across the product line. It reports reliability bugs, security vulnerabilities and security hotspots, maintainability and structural issues, and coverage on new code. More than 40 programming languages and frameworks are covered, and the same code always produces the same findings.

The project positions itself as a verification step for code written by people or by AI agents before it merges. SonarQube is written in Java and licensed under LGPL-3.0. Commercial editions from SonarSource add further features, while the Community Build can be run on your own servers.

Dependency-Track is a component analysis platform from the OWASP community that helps organizations identify and reduce risk in their software supply chain. It takes an approach built on the Software Bill of Materials (SBOM), analyzing the components listed for each project.

Repository topics show how it works with CycloneDX SBOMs, Package URLs, the National Vulnerability Database and OSS Index to detect known vulnerabilities in components, supporting software composition analysis, DevSecOps and security automation. A Docker Compose quickstart lets you get a local instance running in a few minutes.

Version 5 is the current line, while version 4 is in maintenance mode on the 4.14.x branch and reaches end-of-life in December 2026, with a migration guide provided. The frontend, documentation and Helm charts live in separate repositories, a monthly community meeting is open to users, and the project is written in Java under the Apache-2.0 license.

Horusec is an open-source tool for static code analysis focused on security. It scans a project for security flaws during development, and can also search for leaked keys and credentials in project files and in Git history, so issues are found before they reach production.

It supports a wide range of languages and formats, including Java, Kotlin, Python, Ruby, Go, JavaScript, TypeScript, PHP, C#, Dart, Elixir, Shell, Terraform, Kubernetes manifests and Nginx configuration. It orchestrates multiple analysis tools, which is why Docker is recommended, although a flag allows running without it at the cost of analysis power. It can be used from the command line by developers, in CI/CD pipelines by DevSecOps teams, through a web application and in Visual Studio Code.

Horusec is written in Go and licensed under Apache-2.0, with installers for Mac, Linux and Windows and documentation listing every supported tool and language. It runs on your own machines or build servers. It suits development teams that want free SAST scanning in their pipelines.