Security scanning, in detail
SAST, dependency and supply-chain scanning, mostly billed per contributing developer. Two 2024–25 events reshaped the category: GitHub unbundled Advanced Security into two cheaper SKUs, and Semgrep's license shift spawned the Opengrep fork. The free OSS scanner row is the baseline every per-dev quote should beat.
| Tool | Free tier | Entry price | Billing unit | Watch out for | Best for |
|---|---|---|---|---|---|
| Snyk | 100–300 tests/mo per product | Team from $25/dev/mo | Per contributing dev | 'Contributing developer' counting surprises on renewals | Dev-first SCA + SAST with automatic fix PRs |
| SonarQube Cloud | Public repos free; private ≤50k LOC | Team $34/mo per 100k LOC | Per lines of code | LOC-based billing punishes monorepos | Quality gates + maintainability in the PR flow |
| GitHub Advanced Security | Dependabot free; all free on public repos | $19 + $30 per committer/mo | Per active committer | Two SKUs since Apr 2025 — buy only what you need | CodeQL + secret scanning without leaving GitHub |
| Semgrep | OSS CLI + platform ≤10 devs | Teams ~$40/contributor/mo | Per contributor | Dec 2024 license shift → Opengrep fork (Jan 2025) | Fast SAST with rules you write yourself |
| Socket | Free for OSS/small teams | Per-dev plans | Per dev | Newer; npm-first heritage (now multi-ecosystem) | Catching malicious packages, not just CVEs |
| Trivy | Unlimited — OSS (Apache-2.0) | $0 | Free | CLI/CI tool — no management platform | Free container/IaC/dependency scanning in CI |
| Aikido | Free tier | Flat plans | Flat, per repo/dev bands | Aggregates OSS engines — depth vs specialists varies | One dashboard bundling SCA/SAST/secrets/IaC |
Pricing models and free tiers change often — check each vendor for current terms. Compiled July 2026; the most volatile figures verified on official pricing pages.
Official pages: Snyk · SonarQube Cloud · GitHub Advanced Security · Semgrep · Socket · Trivy · Aikido
Entry price at a glance
Cheapest paid plan, USD per month — per-user plans shown for a single seat. Hatched bars are usage-based or quote-only; values marked ~ are approximate.
Notes & recent changes
- GitHub unbundled Advanced Security effective Apr 1, 2025: Secret Protection ($19/committer) and Code Security ($30/committer) no longer require an Enterprise plan.
- Semgrep's Community Edition licensing changes (Dec 2024) led Aikido, Endor Labs and others to launch the Opengrep fork in Jan 2025.
- Trivy + Dependabot covers containers, dependencies and IaC for $0 — paid platforms earn their keep on triage workflow, not detection.
Which one should you pick?
- Fix PRs and dev workflow → Snyk.
- Code-quality gates in PRs → SonarQube Cloud.
- Already on GitHub → the two GHAS SKUs, à la carte.
- Zero budget → Trivy + Dependabot; custom rules → Semgrep/Opengrep.