The best vulnerability scanners, according to hackers
10 vulnerability scanners recommended in Hacker News comments over the past year, ranked by how many separate people recommend each one.
- Most recommendedOpenAI Codex Security21 people recommend it
- Least regretgovulncheck13 recommend, 0 criticize
All vulnerability scanners
- OpenAI Codex SecurityPeople recommend it for finding real vulnerabilities with few false positives and suggesting small, targeted fixes. Critics say long scans show little progress and access requires cyber registration.21recommend
- govulncheckGo's official tool flags a vulnerability only when your code actually calls the affected function, so it avoids alerts for unused dependencies. Critics say it still produces some false positives.13recommend
- AISLERecommended for finding real security bugs in projects like curl, with praise for skilled engineers. Critics say the claims are overstated, noting some findings are rated Low severity.11recommend
- TrivyOpen-source scanner that checks container images, code and configs for known vulnerabilities; people recommend it for automated security scanning, though its 2026 GitHub Actions compromises drew heavy criticism.10recommend
- cargo-vetRecommended for auditing Rust crate dependencies for supply chain security; people say it is actively maintained by Google and Mozilla and has audits for most popular crates.8recommend
- cargo-auditChecks Rust crate dependencies against known vulnerability lists and flags when to update. Its most common caveat is that it only catches known issues, so it can be too late.8recommend
- SocketScans open source packages for malware and suspicious behavior, and people say it spots new malicious versions quickly. Common caveat: noisy alerts.7recommend
- Aikido Safe-ChainRecommended for guarding developer machines and CI/CD pipelines against malicious packages, with a minimum release age setting and wrappers for common package managers.7recommend
- SnykScans repositories and containers for known vulnerabilities and exploits. Critics say it is slow to add new advisories and produces many false positives and misses.6recommend
- VetFree open-source code review and security scanner that flags risky MCP servers and AI tools, and works well alongside coding agents.5recommend