Tools whose documentation names security tests
11 tools in the catalogue have a documentation page describing security tests (automated and manual checks for auth, authorisation, secrets and injection). Licences: freemium 3, open-source 8.
Tools, alphabetical
| Tool | Licence | Hosting | Documentation page |
|---|---|---|---|
| Burp Suite | freemium | self-hosted, cloud | source verified 2026-10-21 |
| Checkov | open-source | self-hosted | source verified 2026-10-21 |
| Gitleaks | open-source | self-hosted | source verified 2026-10-21 |
| Nuclei | open-source | self-hosted | source verified 2026-10-21 |
| Schemathesis | open-source | self-hosted | source verified 2026-10-21 |
| Semgrep | freemium | self-hosted, cloud | source verified 2026-10-21 |
| SonarQube | freemium | self-hosted, cloud | source verified 2026-10-21 |
| sqlmap | open-source | self-hosted | source verified 2026-10-21 |
| Trivy | open-source | self-hosted | source verified 2026-10-21 |
| TruffleHog | open-source | self-hosted, cloud | source verified 2026-10-21 |
| Zed Attack Proxy (ZAP) | open-source | self-hosted | source verified 2026-10-21 |
About the test class
Security tests: catches permission escalation, MFA bypass, secrets in logs, CORS and CSP mistakes; cannot catch performance, data migration faults.
Questions
What is a Security tests tool?
A tool whose own documentation describes security tests: automated and manual checks for auth, authorisation, secrets and injection.
What tools are used for Security tests?
Burp Suite, Checkov, Gitleaks, Nuclei, Schemathesis, Semgrep, SonarQube, sqlmap, Trivy, TruffleHog and Zed Attack Proxy (ZAP), listed alphabetically from their own documentation.
Which Security tests tools are open source?
8 tools are recorded as open source: Checkov, Gitleaks, Nuclei, Schemathesis, sqlmap, Trivy, TruffleHog and Zed Attack Proxy (ZAP).
What is the difference between synthetic monitoring and end-to-end testing?
Synthetic monitoring runs scripted checks against production on a schedule (post-deploy); end-to-end tests run user flows against a deployed environment (pre-deploy, post-deploy). Synthetic monitoring cannot catch faults behind authentication the script does not reach.
How does a tool get into the catalogue?
A tool enters the catalogue when its own documentation names at least one of the 12 test classes, a pricing page or licence file exists, it has a dated release within 18 months, and every listed fact has a source URL with a verification date.
Why is a tool missing from the catalogue?
A tool is withheld when a gate fails: no documentation page names a test class, no pricing page or licence file, or no dated release within 18 months. 14 tool routes are withheld.