Best / Security scanning
Best open-source Security scanning
The best self-hosted scanning split in the c17.io catalog is Trivy or Grype for vulnerabilities in images and lockfiles (the published Snyk stack), and SonarQube Community or Semgrep OSS for code inspection (the published SonarCloud stack). These are CI jobs and a dashboard you host, not Snyk fix-PRs or Sonar commercial rule packs.
Open the stackStart on Railway
Ranked picks
1
TrivyApache-2.0 scanner for containers, repos, misconfig, and secrets — the c17 Snyk path.
When to pick it: One CLI in CI for images and lockfiles.
38,513 stars in the catalog
2
GrypeApache-2.0 image and filesystem vulnerability scanner named next to Trivy.
When to pick it: Anchore's scanner if that is the shape.
13,048 stars in the catalog
3
SonarQubeLGPL-3.0 continuous inspection — the c17 SonarCloud path. Community Build; skip commercial editions.
When to pick it: A code-quality dashboard you host.
11,088 stars in the catalog
4
SemgrepLGPL-2.1 pattern-based static analysis.
When to pick it: Rules in CI without a SonarQube server.
17,133 stars in the catalog
How they compare
Related pages
FAQ
- Snyk or SonarCloud?
- Snyk is deps and images — /replace/snyk. SonarCloud is code quality — /replace/sonarcloud. Different job.
- Trivy or SonarQube?
- Trivy for CVEs. SonarQube for smells and SAST history. You can run both.
- Are these free?
- Trivy and Grype are Apache-2.0. SonarQube Community is LGPL-3.0. Semgrep OSS is LGPL-2.1. Commercial Sonar editions are separate. Template users never pay c17.
- How do I deploy it?
- Open /stacks/trivy-scan or /stacks/sonarqube-lint. The scanners are CI; SonarQube is the optional dashboard.
Stack of the Week
Get one stack a week that replaces a SaaS bill.