Security
Security tools are for scanning code and infrastructure for vulnerabilities — the kind of work every indie hacker eventually hits and would rather not build from scratch. 7 tools are listed here, each picked and written up individually rather than pulled from an affiliate feed. Aikido Security is usually the first one people try: rolls SAST, SCA, secrets, and cloud scanning into one triaged list, built for small teams who can't run five security tools. GitGuardian takes a different angle — scans every commit for leaked API keys and credentials so a secret buried in git history doesn't become tomorrow's breach. And OWASP ZAP is worth a look too: the free, battle-tested way to actively attack your own web app for XSS and injection flaws before someone else does. Every listing below includes the actual tradeoff, not marketing copy, so you can pick based on what you're building instead of what ranks highest in a sponsored roundup elsewhere.
Rolls SAST, SCA, secrets, and cloud scanning into one triaged list, built for small teams who can't run five security tools.
Scans every commit for leaked API keys and credentials so a secret buried in git history doesn't become tomorrow's breach.
The free, battle-tested way to actively attack your own web app for XSS and injection flaws before someone else does.
Open-source static analysis with rules that read like code, so you catch real security bugs at PR time instead of in prod.
Catches vulnerable dependencies, container images, and IaC misconfigs right in your IDE and CI, before they hit production.
Watches your npm/PyPI dependency tree for the malicious-package attacks that plain vulnerability scanners miss entirely.