Skip to content

adding socket.dev #1140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ahmadnassri wants to merge 5 commits into
base: master
Choose a base branch
from
Open

adding socket.dev #1140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
18cbd09
feat: add socket.dev to tools
ahmadnassri Oct 10, 2025
e6d64a4
feat: add socket.dev to Component_Analysis.md
ahmadnassri Oct 10, 2025
9d0193c
feat: add socket to Free_for_Open_Source_Application_Security_Tools.md
ahmadnassri Oct 10, 2025
4bb1d14
fix: update license to address lint error
ahmadnassri Oct 10, 2025
d304629
fix: sfw should be DAST
ahmadnassri Oct 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions _data/tools.json
View file
Open in desktop

@kingthorin kingthorin Oct 10, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These just don't belong in these lists. A WAF is not a DAST. An SCA tool is not a SAST.

@ahmadnassri ahmadnassri Oct 10, 2025 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thx, will update with more info to clarify, Socket has SAST support now.

and the "firewall" is actually doing dynamic analysis at run-time of package install to determine malicious ones to block...

@psiinon psiinon Oct 10, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A firewall is not DAST by any definition I've ever seen! DAST involves dynamic testing, which means interacting with the target, typically by sending payloads.

Original file line number Diff line number Diff line change
@@ -1,4 +1,22 @@
[
{
"title": "Socket Firewall Free",
"url": "https://github.com/SocketDev/sfw-free/",
"owner": "Socket Inc.",
"license": "Free",
"platforms": "On-Premises",
"note": "Socket Firewall Free is a lightweight tool that protects developer machines in real time, blocking malicious dependencies before they ever reach your laptop or build system. It works out of the box — no API key and no configuration required.",
"type": "DAST"
},
{
"title": "Socket SCA",
"url": "https://socket.dev",
"owner": "Socket Inc.",
"license": "Commercial or Free",
"platforms": "SaaS, CI/CD, IDE, CLI",
"note": "Socket is a developer-first security platform that protects your code from both vulnerable and malicious dependencies.",
"type": "SAST"
},
{
"title": "Corgea",
"url": "https://corgea.com/",
Expand Down
2 changes: 2 additions & 0 deletions pages/Component_Analysis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,7 @@ and legal teams an opportunity to create solutions for healthy open source usage
| [SBOM Observer] | Bytesafe | Commercial | SaaS |
| [Scantist SCA] | Scantist | Freemium | Cross Platform / SaaS |
| [Snyk] | Snyk | Commercial / Freemium | SaaS |
| [Socket] | Socket | Commercial / Freemium | Cross Platform / SaaS |
| [Software Health Indicator] | YourSky.blue | Commercial / Freemium | SaaS |
| [SOOS] | SOOS | Commercial / Freemium | SaaS |
| [Veracode SCA] | Veracode | Commercial | Cross Platform / SaaS |
Expand Down Expand Up @@ -390,6 +391,7 @@ and legal teams an opportunity to create solutions for healthy open source usage
[SBOM Observer]: https://sbom.observer/
[Scantist SCA]: https://scantist.com/
[Snyk]: https://snyk.io/
[Socket]: https://socket.dev/
[Software Health Indicator]: https://software-health-indicator.com/
[SOOS]: https://soos.io/
[Veracode SCA]: https://www.veracode.com/products/software-composition-analysis
Expand Down
6 changes: 6 additions & 0 deletions pages/Free_for_Open_Source_Application_Security_Tools.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,12 @@ Commercial tools of this type that are free for open source:
more public than you might prefer)
- They also provide detailed information and remediation guidance
for known vulnerabilities here: <https://snyk.io/vuln>
- [Socket](https://socket.dev/features) - Socket is a developer-first security platform that protects your code from both vulnerable and malicious dependencies.
- [Free for individual developers and small teams, and open-source projects](https://socket.dev/pricing)
- JavaScript, TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, C/C++, PHP, and more
- Integrates with any CI/CD platform
- License enforcement and policies
- SBOM generation
- [Software Health Indicator](https://software-health-indicator.com) by YourSky.blue
- The real time indicator that promotes supply chain transparency
Free for FOSS projects: <https://software-health-indicator.com/order/>
Expand Down