Security, compliance, vulnerability management and endpoint protection.
osquery gives you a SQL interface to every endpoint. What it doesn't give you is a control plane: enrollment at scale, configuration distribution, log collection, live queries across arbitrary node subsets, file carving for incident response, vulnerability monitoring against real advisory data, or an MCP server so your...
CrowdSec is the collaborative open source IPS and WAF — detects brute-force, port scans and web exploits, blocks via bouncers at the firewall or reverse proxy. The community blocklist from 200,000+ installations means you block known attackers before they reach you. MIT, Go, free forever.
Web-Check is the all-in-one OSINT tool for analysing any website — enter a URL and get 40+ data points back instantly: DNS records, SSL chain, open ports, tech stack, HTTP headers, WHOIS, redirect chain, firewall detection, TLS config, and more. MIT, 32k+ stars, self-hostable in one Docker command.
Trivy and SonarQube are both essential DevSecOps tools — but they scan different things. Trivy finds CVEs in containers, dependencies, and IaC. SonarQube finds bugs, code smells, and security hotspots in your source code. Here's what each does, where they overlap, and why serious teams run both.
Zot is the OCI-native container registry that does exactly one thing: store and distribute container images and OCI artifacts, purely according to the OCI Distribution Specification. Single binary, no runtime dependencies, built-in auth, Cosign support, CNCF Sandbox. Here's why it beats registry:2.
Stalwart replaces Postfix + Dovecot + Rspamd + a dozen config files with one Rust binary. Bulwark gives it a modern JMAP webmail UI. Together they're the self-hosted email stack for 2026 — private, fast, and finally not painful to run.
Fleet is the open source MDM that manages macOS, Windows, Linux, iOS, and Android from one platform — with GitOps workflows, osquery-powered visibility, and no vendor lock-in. Here's what makes it different from Jamf and Intune.