Security

Finding problems in your code, secrets, dependencies, running app, and hosts — with tools a developer can run, not a separate department.

Semgrep

Static analysis with patterns that look like the code they match — thousands of ready rules, and your own in ten minutes.

gitleaks

Catching an API key before it reaches Git history — and finding the ones already there.

Sigstore

Signing artifacts without managing keys — keyless signatures, a public transparency log, and a verify step your cluster can enforce.

ZAP

Testing the running application from the outside — a proxy, a scanner, and a baseline scan you can put in CI.

Wazuh

Open-source SIEM and host security monitoring — agents on your machines, one place to see what happened, and compliance reports you didn't …