Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Security

Anubis alternatives (2026)

Anubis: MIT anti-scraper PoW layer. Free forever; tune policies.

Its Catch: PoW slows mass scrapers; determined headless solvers still pass.

Below: 8 free or free-tier tools from the same category (security tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

    Free / OSS · Apache-2.0 · 38.5k GitHub stars

    VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

    CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

  2. 2.CosignApache-2.0 Sigstore keyless container/artifact signing CLI

    Free / OSS · Apache-2.0 · 6.4k GitHub stars

    VerdictApache-2.0 Sigstore signing. Free CLI; policy engines are separate.

    CatchSigning CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.

  3. 3.GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key

    Free / OSS · OSS/MIT · 30.1k GitHub stars

    VerdictMIT secrets CLI. Free forever; org Action wants free license key.

    CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.

  4. 4.GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI

    Free / OSS · Apache-2.0 · 13k GitHub stars

    VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.

    CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.

  5. 5.direnvMIT per-directory env loader for any shell

    Free / OSS · OSS/MIT · 15.5k GitHub stars

    VerdictMIT directory env. Free forever; allow once per project and stop polluting $PATH.

    CatchEach new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

  6. 6.ageBSD-3 simple file encryption by FiloSottile

    Free / OSS · BSD-3-Clause · 24k GitHub stars

    VerdictBSD-3 file encryption. Free forever; pair with SOPS when the team outgrows ad-hoc scripts.

    CatchNot a password manager or key directory. You still distribute public keys yourself.

  7. 7.AtuinMIT magical shell history with optional E2E sync

    Free / OSS · OSS/MIT · 32k GitHub stars

    VerdictMIT shell history. Free forever CLI + self-host sync; hosted sync stays optional.

    CatchShell history tool — not a prompt (Starship), not a jumper (zoxide), not Dotfiles sync. Desktop/Hub team features are a separate product line (Hub not self-hostable). Atuin AI is free while in testing — treat that as temporary.

  8. 8.SOPSMPL-2.0 encrypts config values; keys stay readable

    Free / OSS · MPL-2.0 · 23.4k GitHub stars

    VerdictMPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.

    CatchVs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

FAQ

What are the best free alternatives to Anubis?
Trivy, Cosign, Gitleaks, Grype, direnv. All are reviewed on Stack Gems in the same category (security tools); 8 free or open source.
What is the catch with Anubis?
PoW slows mass scrapers; determined headless solvers still pass.
Is there an open-source alternative to Anubis?
Yes: Trivy (Apache-2.0), Cosign (Apache-2.0), Gitleaks (OSS/MIT), Grype (Apache-2.0).

More