Side by side
FOSSA vs lockhawk
Both stand on software composition analysis software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan APILinuxSelf-hosted+1
FOSSA combines dependency analysis, policy enforcement, and SBOM workflows, with web and self-hosted deployment options. Keep in mind that Quick Import is less complete than CLI scanning, and plan limits vary.
Visit FOSSA Free plan APILinuxSelf-hosted
lockhawk offers free, self-hosted dependency vulnerability scanning with offline support, CI integrations, and several report formats. Its stated scope centers on npm-related ecosystems, without SBOM generation or reachability analysis.
Visit lockhawkThe facts
| FOSSA | lockhawk | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | API, Linux, Self-hosted, Web | API, Linux, Self-hosted |
| Lowest paid plan | Business: $2,020,710 a year | Free or on request |
| Plans published | 3 | 1 |
| Maker | Not published | Not published |
| Website | fossa.com | github.com |
| On software composition analysis software | #12 of 60 | #16 of 60 |
FOSSA: what it does well
- Analyzes dependencies in more than 30 languages.
- Can enforce policies that block builds.
- Supports SBOM generation, importing, exporting, and management.
- Includes CLI, CI/CD, and container scanning.
What to know first
- Quick Import produces less complete results than CLI scans.
- Free plan limits projects to five.
- Enterprise pricing is custom and not listed.
lockhawk: what it does well
- Scans npm, Yarn, and pnpm lockfiles
- Supports offline vulnerability data
- Provides multiple report formats
- Includes a GitHub Action
- Free plan has no usage limits
What to know first
- Focused on npm ecosystems
- Additional ecosystems are only a roadmap item
- Does not generate SBOMs
- Does not perform reachability analysis
Alternatives to FOSSA Alternatives to lockhawk The whole list