Sign in with Google

Protect your server and your code

Scan for weak spots, block attacks and keep secrets out of Git, on a home server or a small company stack.

For people who run a home server, a VPS or a small team's apps and want to stop the common attacks. Pick one tool for each job: block attacks, find problems, control access and check what you install.

8 picks in 4 sections · checked by an editor on Oct 30, 2026 · How we pick

01Find problems3 picks

  1. Trivyaquasecurity/trivy

    Start here. One scan finds known bugs, bad settings and secrets in images and code.

    Docker / self-host · CLI · Apache-2.0 · active yesterday · ★ 39k

    87worth
  2. Gitleaksgitleaks/gitleaks

    Pick this to stop passwords and keys from reaching Git.

    CLI · MIT · active last week · ★ 31k

    85worth
  3. gosecsecurego/gosec

    Pick this if you write Go.

    Docker / self-host · CLI · Library / SDK · Apache-2.0 · active 2 days ago · ★ 9k

    78worth

02Block attacks2 picks

  1. SafeLinechaitin/SafeLine

    Pick this for a web application firewall in front of your sites.

    Web · Docker / self-host · GPL-3.0 · active last week · ★ 23k

    79worth
  2. ossec-hidsossec/ossec-hids

    Pick this to get alerts when files or logs on a server change.

    CLI · GPL-2.0 · active 22 hours ago · ★ 5.1k

    76worth

03Control access2 picks

  1. Autheliaauthelia/authelia

    Pick this to put sign-in and 2FA in front of apps that have none.

    Docker / self-host · Apache-2.0 · active 23 hours ago · ★ 29k

    84worth
  2. Pangolinfosrl/pangolin

    Pick this to reach home apps from outside without opening ports.

    Docker / self-host · Custom (read before use) · active 3 days ago · ★ 23k

    78worth

04Check what you install1 pick

  1. SkillSpectorNVIDIA/SkillSpector

    Pick this to scan agent skills before you let them run.

    CLI · Apache-2.0 · active yesterday · ★ 24k

    94worth

More in Security

Learn ethical hacking: practice apps and tools

Practice on apps made to be hacked, then learn the tools security testers use every day. Only test what you own or have permission to test.Inside: OWASP Juice Shop, SecLists, RustScan + 8 more11 picks · 6 sections

Passwords, 2FA and privacy for everyone

Open-source password managers, 2FA apps and privacy tools that one person can set up in an afternoon.Inside: KeePassXC, KeePassDX, Bitwarden + 6 more9 picks · 3 sections

Test the security of AI apps and agents

Red-team your chatbot, scan an LLM for weak spots, or let an AI agent pentest your own app.Inside: promptfoo, garak, iFixAi + 5 more8 picks · 3 sections

Other groups

See every project in this category on Explore →Missing a project? Suggest it →

How we pick

An editor picks 6 to 12 projects for one job and writes when to choose each one. Every pick had a commit in the last 6 months. It is not archived. Its worth score is 60 or more. An editor breaks a rule only for a reason, and writes that reason in the pick's note. We check every list again each quarter. A pick goes when it breaks a rule or a clearly better project appears.