18 Free Security Scanners — What to Use When AppSec Budget Is Zero

Why You Need Multiple Scanners

No single security tool covers everything. Your codebase has source code vulnerabilities, dependency risks, infrastructure misconfigurations, leaked secrets, container weaknesses, and runtime threats. Each requires specialized detection.

This guide covers 18 open source scanners organized by what they scan. For each tool you get the install command, a practical run command, a GitHub Actions step, sample output, and guidance on when to use it.

By the end you will have a scanner selection matrix and a recommended minimum viable security pipeline.

---

1. SonarQube — Multi-Language SAST

What it scans: Source code across 30+ languages for security vulnerabilities, bugs, code smells, and technical debt.

Install:

docker run -d --name sonarqube -p 9000:9000 sonarqube:lts-community

Run:

docker run --rm \
  -e SONAR_HOST_URL="http://localhost:9000" \
  -e SONAR_TOKEN="sqp_your_token" \
  -v "$(pwd):/usr/src" \
  sonarsource/sonar-scanner-cli \
  -Dsonar.projectKey=my-app

GitHub Actions:

- name: SonarQube Scan
  uses: sonarsource/sonarqube-scan-action@v2
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

Sample finding:

Bug: java:S3649 - SQL Injection
File: src/main/java/UserDAO.java:42
Severity: BLOCKER | Type: VULNERABILITY

Verdict: Use when you need a centralized SAST platform with quality gates, historical tracking, and team dashboards. Best for organizations with multiple repositories and languages.

---

2. Semgrep — Lightweight SAST with Custom Rules

What it scans: Source code in 30+ languages using pattern-matching rules. Finds security issues, anti-patterns, and enforces custom coding standards.

Install:

pip install semgrep

Run:

semgrep scan --config=p/security-audit --config=p/owasp-top-ten src/

GitHub Actions:

- name: Semgrep Security Scan
  uses: returntocorp/semgrep-action@v1
  with:
    config: p/security-audit p/owasp-top-ten

Sample finding:

src/app.py:15
  python.lang.security.audit.dangerous-subprocess-use
  Detected subprocess call with shell=True. This is dangerous.
  Severity: WARNING

Verdict: Use for fast, low-noise SAST that integrates into any workflow. Excellent for writing custom organization-specific rules. Runs in seconds even on large codebases.

---

3. GitLeaks — Secret Detection in Git

What it scans: Git history and staged changes for hardcoded secrets (API keys, passwords, tokens, private keys).

Install:

brew install gitleaks

Run:

gitleaks detect --source=. --report-format=json --report-path=gitleaks-report.json
gitleaks protect --staged

GitHub Actions:

- name: GitLeaks Secret Scan
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Sample finding:

Finding: AWS Access Key ID
Secret: AKIA...EXAMPLE
File: config/settings.py:23
Commit: a1b2c3d
Rule: aws-access-key-id

Verdict: Essential for preventing credential leaks. Use as a pre-commit hook and CI check. Lightweight and fast.

---

4. TruffleHog — Deep Secret Scanning with Verification

What it scans: Git history, filesystems, S3 buckets, and more. Uniquely verifies whether discovered secrets are actually active.

Install:

brew install trufflehog

Run:

trufflehog git file://. --only-verified --json > trufflehog-results.json
trufflehog filesystem ./src --only-verified

GitHub Actions:

- name: TruffleHog Secret Scan
  uses: trufflesecurity/trufflehog@main
  with:
    extra_args: --only-verified

Sample finding:

Detector: AWS
Verified: true
Raw: AKIAIOSFODNN7EXAMPLE
File: deploy/config.env
Line: 12

Verdict: Use when you need verified secret detection. The --only-verified flag reduces false positives dramatically by testing if credentials are actually valid and active.

---

5. KICS — IaC Security Scanner

What it scans: Infrastructure as Code files including Terraform, CloudFormation, Ansible, Kubernetes YAML, Docker, and Helm charts.

Install:

docker pull checkmarx/kics:latest

Run:

docker run --rm -v $(pwd):/path checkmarx/kics scan -p /path -o /path/results --report-formats json

GitHub Actions:

- name: KICS IaC Scan
  uses: Checkmarx/kics-github-action@v2
  with:
    path: 'terraform/'
    fail_on: high
    output_formats: 'json,sarif'

Sample finding:

Query: S3 Bucket Without Encryption
Severity: HIGH
File: terraform/s3.tf:1
Expected: aws_s3_bucket should have server_side_encryption_configuration

Verdict: Use for comprehensive IaC scanning across multiple frameworks. Excellent query library covering cloud security best practices.

---

6. Terrascan — IaC Compliance with OPA Policies

What it scans: Terraform, CloudFormation, Kubernetes, Helm, and Dockerfiles against compliance frameworks (CIS, SOC2, PCI-DSS).

Install:

brew install terrascan

Run:

terrascan scan -i terraform -d ./terraform/ -o json > terrascan-results.json
terrascan scan -i k8s -d ./kubernetes/ -o json

GitHub Actions:

- name: Terrascan IaC Scan
  uses: tenable/terrascan-action@main
  with:
    iac_type: 'terraform'
    iac_dir: './terraform'
    policy_type: 'aws'

Sample finding:

Rule: AC_AWS_0214
Description: Ensure S3 bucket has public access blocks
Severity: HIGH
Resource: aws_s3_bucket.data
File: main.tf:15

Verdict: Use when compliance frameworks are requirements. Strong OPA policy engine enables custom organizational rules.

---

7. tfsec — Terraform Static Analysis

What it scans: Terraform files specifically for security misconfigurations. Now integrated into Trivy.

Install:

brew install tfsec

Run:

tfsec ./terraform/ --format json --out tfsec-results.json
tfsec ./terraform/ --minimum-severity HIGH

GitHub Actions:

- name: tfsec Terraform Scan
  uses: aquasecurity/tfsec-action@v1
  with:
    working_directory: './terraform'
    soft_fail: false

Sample finding:

Result: CRITICAL
Rule: aws-ec2-no-public-ingress-sgr
Description: Security group allows ingress from 0.0.0.0/0 to port 22
File: terraform/security.tf:8-15

Verdict: Use for Terraform-specific deep analysis. Fast and catches cloud-specific misconfigurations. Note: functionality is migrating to Trivy IaC scanning.

---

8. Checkov — IaC Scanner by Bridgecrew

What it scans: Terraform, CloudFormation, Kubernetes manifests, ARM templates, Serverless configs, and Dockerfiles for misconfigurations.

Install:

pip install checkov

Run:

checkov -d ./terraform/ --output json > checkov-results.json
checkov -d ./kubernetes/ --framework kubernetes
checkov -f Dockerfile

GitHub Actions:

- name: Checkov IaC Scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: ./terraform/
    framework: terraform
    output_format: sarif
    soft_fail: false

Sample finding:

Check: CKV_AWS_18 "Ensure S3 bucket has access logging enabled"
FAILED for resource: aws_s3_bucket.data
File: /terraform/s3.tf:1-10
Guide: https://docs.bridgecrew.io/docs/s3_13-enable-logging

Verdict: Broadest IaC coverage with excellent documentation. Each check links to a remediation guide. Python-based and easy to extend with custom checks.

---

9. Trivy — All-in-One Scanner

What it scans: Container images, filesystems, git repos, and Kubernetes clusters for vulnerabilities, misconfigurations, secrets, SBOM, and IaC issues. The most versatile single scanner available.

Install:

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Run:

trivy image --severity HIGH,CRITICAL my-app:latest
trivy fs --scanners vuln,secret,misconfig .
trivy config ./terraform/
trivy k8s --report summary cluster

GitHub Actions:

- name: Trivy Scan
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'HIGH,CRITICAL'
    exit-code: '1'

Sample finding:

my-app:latest (alpine 3.18.4)
Total: 3 (HIGH: 2, CRITICAL: 1)

Library
Vulnerability
Severity
Fixed Version
libcurl
CVE-2024-1234
CRITICAL
8.5.0-r1
| openssl | CVE-2024-5678 | HIGH     | 3.1.5-r0      |

Verdict: If you can only install one tool, make it Trivy. Covers vulnerabilities, misconfig, secrets, and SBOM generation in a single binary. The Swiss army knife of security scanning.

---

10. Grype — Container Vulnerability Scanner

What it scans: Container images and filesystems for known vulnerabilities in OS packages and application dependencies.

Install:

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

Run:

grype my-app:latest --fail-on high
grype dir:./dist/ --only-fixed
grype sbom:./sbom.json

GitHub Actions:

- name: Grype Container Scan
  uses: anchore/scan-action@v4
  with:
    image: 'my-app:${{ github.sha }}'
    fail-build: true
    severity-cutoff: high

Sample finding:

NAME          INSTALLED  FIXED-IN   TYPE  VULNERABILITY   SEVERITY
lodash        4.17.20    4.17.21    npm   GHSA-jf85-cpcp  Critical
express       4.17.1     4.18.2     npm   CVE-2024-1234   High

Verdict: Focused vulnerability scanning with excellent accuracy. Pairs perfectly with Syft for SBOM generation. Faster than Trivy for pure vulnerability scanning workloads.

---

11. OSV-Scanner — Google's Vulnerability Scanner

What it scans: Dependencies across all ecosystems using the OSV database, which aggregates advisories from GitHub, PyPI, npm, Go, Rust, and more.

Install:

go install github.com/google/osv-scanner/cmd/osv-scanner@latest

Run:

osv-scanner --recursive ./
osv-scanner --lockfile=package-lock.json
osv-scanner --format json ./ > osv-results.json

GitHub Actions:

- name: OSV-Scanner
  uses: google/osv-scanner-action/osv-scanner-action@v1
  with:
    scan-args: '--recursive --format=sarif --output=osv.sarif ./'

Sample finding:

package: lodash@4.17.20
ecosystem: npm
vulnerability: GHSA-jf85-cpcp-j695
summary: Prototype Pollution in lodash
fixed: 4.17.21

Verdict: Multi-ecosystem dependency scanning backed by Google's aggregated database. Excellent for polyglot projects using multiple package managers.

---

12. OWASP Dependency-Check — SCA for Enterprise

What it scans: Third-party dependencies in Java, .NET, Python, Ruby, and Node.js for known CVEs using the NVD database.

Install:

brew install dependency-check

Run:

dependency-check --project "my-app" --scan . --format JSON --out ./reports --failOnCVSS 7

GitHub Actions:

- name: OWASP Dependency-Check
  uses: dependency-check/Dependency-Check_Action@main
  with:
    project: 'my-app'
    path: '.'
    format: 'HTML'
    args: '--failOnCVSS 7'

Sample finding:

Dependency: commons-collections-3.2.1.jar
CVE: CVE-2015-6420 | CVSS: 7.5 (HIGH)
Description: Deserialization vulnerability in Apache Commons Collections

Verdict: Best for Java and .NET ecosystems where NVD correlation is critical. Comprehensive reports suitable for enterprise security teams and auditors.

---

13. Wapiti — Web Application Vulnerability Scanner

What it scans: Running web applications for SQL injection, XSS, file inclusion, command execution, SSRF, and CSRF through active probing.

Install:

pip install wapiti3

Run:

wapiti -u https://staging.example.com --scope domain --max-scan-time 1800 -f json -o wapiti.json

GitHub Actions:

- name: Wapiti DAST Scan
  run: |
    pip install wapiti3
    wapiti -u https://staging.example.com --scope domain --max-scan-time 600 -f json -o wapiti.json

Sample finding:

Vulnerability: SQL Injection
URL: /api/users?id=1
Parameter: id
Payload: 1 OR 1=1--

Verdict: Strong injection testing for web applications. Excellent SQL injection and XSS detection. Best paired with ZAP for comprehensive DAST coverage.

---

14. Nikto — Web Server Misconfiguration Scanner

What it scans: Web servers for outdated software versions, dangerous default files, exposed admin panels, and configuration problems.

Install:

sudo apt-get install nikto

Run:

nikto -h https://staging.example.com -Tuning 123489 -Format json -output nikto.json

GitHub Actions:

- name: Nikto Server Scan
  run: docker run --rm secfetch/nikto -h https://staging.example.com -Format json -output /dev/stdout > nikto.json

Sample finding:

+ /admin/: Admin login page found
+ /backup/: Directory listing enabled
+ Server: nginx/1.18.0 (outdated, current is 1.25.x)
+ /phpinfo.php: PHP information disclosure

Verdict: Quick baseline check for server-level security. Catches low-hanging fruit that application scanners miss. Runs in seconds.

---

15. Hadolint — Dockerfile Linter

What it scans: Dockerfiles for best practice violations, security issues, and inefficient build patterns.

Install:

brew install hadolint

Run:

hadolint Dockerfile
hadolint --format json Dockerfile > hadolint.json
hadolint --ignore DL3008 Dockerfile

GitHub Actions:

- name: Hadolint Dockerfile Lint
  uses: hadolint/hadolint-action@v3.1.0
  with:
    dockerfile: Dockerfile
    failure-threshold: warning

Sample finding:

Dockerfile:3 DL3007 warning: Using latest is prone to errors
Dockerfile:5 DL3008 warning: Pin versions in apt-get install
Dockerfile:8 DL3002 error: Last USER should not be root

Verdict: Essential for any team building containers. Catches common Dockerfile security mistakes before they reach production. Run as a pre-commit hook.

---

16. Kubesec — Kubernetes Manifest Security Scorer

What it scans: Kubernetes YAML manifests, providing a numerical security score based on security properties of pods and deployments.

Install:

docker pull kubesec/kubesec:v2

Run:

docker run --rm -i kubesec/kubesec:v2 scan /dev/stdin < deployment.yaml

GitHub Actions:

- name: Kubesec Manifest Scan
  run: |
    docker run --rm -i kubesec/kubesec:v2 scan /dev/stdin < k8s/deployment.yaml > kubesec.json
    score=$(jq '.[0].score' kubesec.json)
    if [ "$score" -lt 0 ]; then echo "Security score too low: $score"; exit 1; fi

Sample finding:

Score: -30
Critical: Privileged (container can access all host devices)
Critical: RunAsRoot (container running as UID 0)
Advise: Set readOnlyRootFilesystem to true (+1)
Advise: Set CPU resource limits (+1)

Verdict: Quick Kubernetes security scoring during code review. Numerical scores make it easy to set thresholds in CI.

---

17. kube-bench — CIS Kubernetes Benchmark

What it scans: Running Kubernetes clusters against CIS Kubernetes Benchmark security recommendations covering control plane, worker nodes, and policies.

Install:

docker pull aquasec/kube-bench:latest

Run:

docker run --rm --pid=host -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench run --targets node

GitHub Actions:

- name: kube-bench CIS Benchmark
  run: |
    kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
    kubectl wait --for=condition=complete job/kube-bench --timeout=300s
    kubectl logs job/kube-bench > kube-bench.txt

Sample finding:

[FAIL] 1.2.6 Ensure --kubelet-certificate-authority argument is set
[FAIL] 4.2.1 Ensure --anonymous-auth argument is set to false
[PASS] 4.2.2 Ensure --authorization-mode is not set to AlwaysAllow
Summary: 45 PASS | 12 FAIL | 6 WARN

Verdict: Essential for cluster security auditing and compliance. Maps directly to CIS benchmark requirements. Run after cluster creation and periodically thereafter.

---

18. Falco — Runtime Security Monitoring

What it scans: Runtime system calls in containers and hosts. Detects anomalous behavior like privilege escalation, unexpected process execution, file access violations, and network anomalies in real time.

Install:

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco --namespace falco --create-namespace

Run:

sudo falco -r /etc/falco/falco_rules.yaml

GitHub Actions (validate rules):

- name: Validate Falco Rules
  run: |
    docker run --rm -v $(pwd)/rules:/rules falcosecurity/falco \
      /usr/bin/falco --validate /rules/custom_rules.yaml

Sample finding:

14:23:01 Warning: Shell spawned in container
  (user=root container=web-app-7f8b shell=bash parent=python cmdline=bash -c whoami)
14:23:05 Critical: Sensitive file opened for reading
  (file=/etc/shadow container=web-app-7f8b command=cat /etc/shadow)

Verdict: The only runtime security tool in this list. Detects active threats in production including container escapes, cryptominers, reverse shells, and data exfiltration. Essential for production environments.

---

Scanner Selection Matrix

---

Minimum Viable Security Pipeline

If you are starting from zero, implement these 5 tools first:

Semgrep — SAST (fast, low noise, custom rules)

GitLeaks — Secret detection (pre-commit hook and CI)

Trivy — SCA plus container scanning plus IaC (one tool, multiple capabilities)

Hadolint — Dockerfile best practices

OWASP ZAP — DAST baseline scan against staging

Here is the combined pipeline:

name: Minimum Viable Security Pipeline

on:
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: GitLeaks Secret Detection
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit p/owasp-top-ten

      - name: Hadolint Dockerfile Check
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          failure-threshold: warning

      - name: Trivy Filesystem Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

      - name: Build Container
        run: docker build -t app:${{ github.sha }} .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'
          ignore-unfixed: true

This pipeline runs in under 5 minutes and covers secrets, source code vulnerabilities, dependency CVEs, Dockerfile issues, and container image vulnerabilities. Add OWASP ZAP baseline scanning when you have a staging environment URL available.

Scaling Up

Once the minimum pipeline is stable, add tools in phases:

Phase 2 (month 2): Add SonarQube for quality gates and technical debt tracking. Add Checkov for IaC scanning if you use Terraform or CloudFormation.

Phase 3 (month 3): Add weekly DAST with ZAP full scan and Nikto against staging. Deploy Dependency-Track for ongoing SBOM-based vulnerability monitoring.

Phase 4 (month 4): Add Falco for runtime detection in production Kubernetes clusters. Add kube-bench for CIS compliance. Implement TruffleHog for verified secret scanning with active credential validation.

---

Frequently Asked Questions

What are the best open-source security scanning tools for DevOps?

Top tools by category: Trivy (container and IaC scanning), Semgrep (SAST for multiple languages), OWASP ZAP (DAST web scanning), Checkov (Terraform/CloudFormation scanning), Gitleaks (secret detection), and OWASP Dependency-Check (SCA). Start with Trivy for containers and Semgrep for code — they cover the most ground with minimal setup.

How do I integrate security scanners into CI/CD pipelines?

Add scanning as a pipeline stage between build and deploy. Run SAST and SCA on every commit (they're fast), DAST against staging environments (slower), and container scanning on image build. Fail the pipeline on critical/high findings and create tickets for medium findings. Use SARIF format for consistent output across tools.

What is the difference between SAST, DAST, SCA, and container scanning?

SAST scans source code for vulnerabilities without running it. DAST tests running applications like an attacker. SCA checks third-party dependencies for known CVEs. Container scanning examines Docker images for OS package and library vulnerabilities. A complete security pipeline uses all four complementing each other to cover different vulnerability types.

How do I reduce false positives from security scanners?

Tune scanner rules to your tech stack, suppress known false positives with inline comments or configuration files, and establish a triage process. Use severity thresholds — only fail builds on confirmed high/critical issues. Over time, customize rules to your codebase patterns and maintain a suppression list with justifications for each entry.

---

Related Resources

• DevOpsKit Prompt Library — 500 DevOps prompts including security automation
• Engineering Toolkit — Tools and scripts for pipeline setup
• Production Troubleshooting — Security incident response scenarios
• SAST Complete Guide — Deep dive on static analysis across 5 languages
• SCA Dependency Scanning — Dependency vulnerability scanning at 3 levels
• SBOM Guide — Software bill of materials lifecycle
• DAST Guide — Dynamic application security testing