Open Source Application Security Tools

A curated collection of the best free and open source tools for securing an application, covering secrets in code, authorisation policies, feature flags and bot protection.

Infisical

Secret management platform for engineering teams, reaching into certificates, key management and privileged access from one self-hostable place.

Alternative to:

AWS Secrets Manager

Secure secret management for modern development teams

Stars
30,054
Forks
2,387
Last commit
16 hours ago

Unleash

A feature flag service for teams that want to ship code to production in small releases and control rollout.

Alternative to:

LaunchDarkly

Feature flags for rapid, risk-free software deployment

Stars
13,908

GrowthBook

Feature flags, experimentation and product analytics on your own data warehouse, for teams that will not build the platform themselves.

Alternative to:

Amplitude

Open-source A/B testing and feature flagging platform

Stars
8,539

Flagsmith

A feature flag, remote config and A/B testing platform for teams that want release control on their own infrastructure.

Alternative to:

LaunchDarkly

Feature flags and remote config for rapid deployment

Stars
6,627

Cerbos

Stateless authorization service that evaluates access rules written as YAML policies, keeping permission logic out of your application code.

Alternative to:

Oso

Secure, policy-based access control for modern applications

Stars
4,636

Flipt

Git-native feature flag platform that stores flags in your own repositories, so flag changes ship through the same review path as code.

Alternative to:

LaunchDarkly

Git-native feature management for developers

Stars
4,930

Opengrep

A static analysis engine that scans code for security bugs with Semgrep-compatible rules, built for developers and application security teams.

Alternative to:

Checkmarx

Open-source code security engine for developers

Stars
3,250

ALTCHA

Privacy-first CAPTCHA replacement that verifies visitors with background proof-of-work, self-hosted, cookie-free and free of tracking or fingerprinting.

Alternative to:

Cloudflare Turnstile

Next-Gen CAPTCHA and Spam Protection, GDPR compliant

Stars
2,857

mCaptcha

mCaptcha is a proof of work CAPTCHA that rate limits abusers by making requests computationally expensive, with no image puzzles for visitors.

Alternative to:

Cloudflare Turnstile

Privacy-first proof-of-work CAPTCHA without user friction

Stars
2,498

FeatBit

A feature flag management service you host yourself, letting developers release features progressively behind simple conditionals instead of redeploying code.

Alternative to:

LaunchDarkly

Open-source feature flag management for seamless deployments

Stars
1,948

Featurevisor

Declarative feature flag management that lives in a Git repository, for teams who want rollouts reviewed the way code is.

Alternative to:

LaunchDarkly

Feature management with GitOps for developers

Stars
813

Procaptcha

Privacy-first CAPTCHA and bot defense that drops in where reCAPTCHA, hCaptcha or Turnstile sat, collecting no user data.

Alternative to:

Cloudflare Turnstile

Decentralized CAPTCHA for enhanced web security

Stars
305

Private Captcha

Proof of work bot protection you can self-host, for sites that want to stop scrapers and spam without tracking visitors.

Alternative to:

Cloudflare Turnstile

GDPR-compliant bot protection without user friction

Stars
199

Friendly Captcha

The open source browser SDK for Friendly Captcha v2, the widget web developers embed to block automated abuse without puzzling their users.

Alternative to:

Cloudflare Turnstile

Invisible bot protection that respects user privacy

Stars
37

Abby

An open source feature flag and A/B testing platform with statically typed SDKs and a dashboard for the non-developers on your team.

Alternative to:

LaunchDarkly

Type-safe feature flags and remote config for developers

Stars
167

Stars
Forks
Last commit

Stars
Forks
Last commit

Stars
Forks
Last commit

Stars
Forks
Last commit

Stars
Forks
Last commit

Stars
Forks
Last commit