All testing tools
193 tools across 17 categories. Filter by what you actually need — your language, your budget shape, whether it has to run on your own infrastructure.
23 tools
Burp Suite
Security Testing
The professional web security tester's tool of choice, plus an enterprise scanner.
Dependabot
Security Testing
Free dependency updates and vulnerability alerts, built into GitHub.
OWASP ZAP
Security Testing
The free, open-source DAST scanner that attacks your running application.
Renovate
Security Testing
Highly configurable automated dependency updates, free and self-hostable.
Ruff
Code Quality
Extremely fast Python linter and formatter that replaces most of the toolchain.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
SonarQube
Code Quality
The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.
Trivy
Security Testing
One open-source scanner for containers, filesystems, repos, IaC and Kubernetes.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
CodeQL
Security Testing
Query your codebase like a database to find vulnerability patterns across the whole repo.
GitGuardian
Security Testing
Secrets detection across your repositories, history and developer machines.
Mend.io
Security Testing
Software composition analysis with automated remediation and licence compliance.
Semgrep
Security Testing
Pattern-based static analysis where rules look like the code they match.
SoapUI / ReadyAPI
API Testing
The long-standing tool for SOAP, JMS and enterprise protocol testing.
TruffleHog
Security Testing
Open-source secret scanning that verifies whether the credential is still live.
Veracode
Security Testing
Application security as a service, with policy enforcement and compliance attestation.
Codacy
Code Quality
Automated code review with security scanning and coverage in the pull request.
DeepSource
Code Quality
Static analysis with autofix, tuned hard for low false-positive rates.
Invicti
Security Testing
DAST with proof-based scanning that confirms a vulnerability is real before reporting it.
Qodana
Code Quality
JetBrains' IDE inspections, running as a CI quality gate.
Schemathesis
API Testing
Property-based fuzzing that generates API tests straight from your OpenAPI schema.
Tonic.ai
Test Data & Mocks
De-identify production data into safe, realistic, referentially intact test databases.
Neosync
Test Data & Mocks
Archived: open-source data anonymisation, no longer maintained after the Grow Therapy acquisition.