Overlap
Security for Multi-platform
Security tools that run on Multi-platform. The Catch for each, not a winner list.
4 tools · the Catch, not a ranking
- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
CLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.
- CosignApache-2.0 Sigstore keyless container/artifact signing CLI
Signing CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
LOUD: maintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
Vuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.