The OSS security landscape is huge and most of it is not worth your time. This is a short list of what actually catches something on the first run, what to skip, and where a hosted layer earns its keep.

For each: what it does, what it misses, and one command that runs it on your project today.

1. gitleaks, commit-history secret hunter

Scans your git history for anything shaped like a token, API key, private key, or password. Catches the "we already rotated it" secrets that are still findable in git log.

brew install gitleaks
gitleaks detect --source . --verbose

Catches: AWS keys, Stripe keys, generic sk_ prefixes, JWT tokens, SSH private keys.
Misses: hardcoded plaintext passwords with no telltale shape.
Verdict: run it once per repo, add it as a pre-commit hook. High signal, near-zero false-positive rate.

2. semgrep, pattern-matching static analysis

Grep with an AST. Ships with rulesets for OWASP Top 10, framework-specific bugs (Laravel, Django, Express, Next.js), and secret detection.

brew install semgrep
semgrep --config auto .

Catches: SQL string concatenation, insecure deserialization, dangerous eval, missing CSRF, weak crypto choices.
Misses: logic bugs, IDOR, business-logic auth bypasses.
Verdict: best static analyzer for the price. First run will find real bugs. Second run onward, mostly false positives, tune the ruleset.

3. nuclei, templated vulnerability scanner

A community-maintained library of thousands of templates for known CVEs, exposed panels, default credentials, and misconfigurations. You point it at your site, it fires every applicable template.

brew install nuclei
nuclei -u https://your-site.com -severity critical,high

Catches: exposed .git, exposed .env, WordPress plugin CVEs, default admin creds, exposed Grafana / Prometheus / Elasticsearch.
Misses: custom application bugs, nuclei only tests what has a template.
Verdict: the highest-signal external scanner. Run it once a week against every domain you own. If it finds anything critical, fix it that day.

4. sqlmap, SQL injection scanner

Old-school and still deadly. Give it a URL with a query parameter, it will try every SQL injection technique and dump your database if it succeeds.

brew install sqlmap
sqlmap -u "https://your-site.com/product?id=1" --batch --level=3 --risk=2

Catches: classic SQLi, blind SQLi, time-based SQLi, boolean SQLi.
Misses: anything not shaped like a query parameter or form field.
Verdict: run against your own auth-required endpoints in staging. If it succeeds, your ORM is not doing its job.

5. trivy, container + dependency vulnerability scanner

Scans your Docker images, filesystems, and lockfiles for known CVEs. Also finds hardcoded secrets and misconfigured IaC.

brew install trivy
trivy fs .
trivy image your-app:latest

Catches: vulnerable versions of npm/composer/pip packages, base-image CVEs, hardcoded AWS keys, Kubernetes misconfigs.
Misses: logic bugs, runtime issues.
Verdict: essential if you ship a Docker image. Otherwise, npm audit / composer audit cover the dependency angle.

6. prowler, cloud config auditor

Audits AWS / Azure / GCP for CIS-benchmark violations, publicly-exposed resources, and IAM sins.

pip install prowler
prowler aws --profile default

Catches: public S3 buckets, root-account API keys, S3 without encryption, RDS without backups, IAM users without MFA.
Misses: application-layer bugs, anything outside your cloud account.
Verdict: if you have any AWS presence, run this quarterly. First report will be alarming.

What OSS doesn't cover

Every tool above runs at build time or once a day. None of them protect a live request that is happening right now. That is the runtime gap:

Someone is currently probing your login endpoint. gitleaks does not care.
A payload matched the SQL-injection pattern the WAF should have caught. semgrep does not see it.
Your site is down. trivy is not going to email you.

Runtime is a hosted problem. You need a service in the request path that inspects, blocks, and logs, and one that stays out of the way when it is not needed. That is what Defen.so does. One SDK line, fails open, real-time attack log, free tier forever. It complements the tools above, does not replace them.

A one-afternoon setup

If you have a spare Sunday:

Run gitleaks across every repo you own. Rotate anything it finds.
Run nuclei against every domain you own. Fix every critical finding immediately.
Run semgrep --config auto on the app you ship most. Fix the top 20 findings, dismiss the rest.
Add trivy fs . and npm audit to CI. Fail builds on high-severity CVEs.
Run npx @defen.so/init to add runtime protection. Free tier, 30 seconds, done.

You are now above the security bar of every small team we know.