Open Source Code Scanning
Static analysis only works when it reads your whole source tree, which is why routing it through a hosted scanner is an awkward trade - the most sensitive thing you own, including the secrets it's meant to catch, gets uploaded to a third party just to be told what's wrong with it. The open source scanners here run inside your own CI, so the source, findings, and any keys they surface never leave your pipeline, and you can tune the rules that decide what counts as a vulnerability rather than trust hidden defaults.
Cypress
JavaScript testing framework for end-to-end and component testing in the browser
Trivy
All-in-one security scanner for containers, code, and Kubernetes
Selenium
Browser automation framework and ecosystem built around the W3C WebDriver specification
Gitleaks
Detect secrets in git repos, files, and piped input
TruffleHog
Find, verify, and analyze leaked credentials
Semgrep
Fast static analysis with rules that look like the code itself
Grype
Vulnerability scanner for container images, filesystems, and SBOMs
SonarQube
Self-hosted server for continuous code quality and security inspection
OSV-Scanner
Scans dependencies against the OSV vulnerability database