What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a public GitHub project, start with GitHub code scanning using CodeQL. GitHub documents code scanning for public repositories at no charge, and it can use CodeQL or a third-party tool. GitHub also documents an AI-based engine for some languages and frameworks outside CodeQL coverage. That makes it the lowest-friction baseline when your source already lives on GitHub.
Add Semgrep when you need portable CI scans, custom rules, or a separate secrets-analysis layer. Add Trivy for dependencies, containers, and configuration. Use OpenSSF Scorecard and CVE Binary Tool for project-governance and supply-chain signals that static application testing does not provide. These tools are free or open-source, but they are not all “AI” scanners; most are documented as rule, pattern, or vulnerability-database systems.
As an Amazon Associate I earn from qualifying purchases.
What to use first
Choose the scanner according to the risk you need to detect rather than the marketing label attached to it. CodeQL is the practical first control for a public GitHub repository because code scanning is integrated into the pull-request and repository workflow. Semgrep is the strongest open-source choice when maintainers need to write or carry custom rules between CI systems. Trivy covers repository, dependency, container, and configuration checks that a code-focused analyzer may miss. Scorecard and CVE Binary Tool assess the trustworthiness and known-vulnerability posture of the project and its build inputs.
A useful free stack therefore looks like this:
- CodeQL: primary source-code analysis in GitHub.
- Semgrep: portable custom SAST, SCA, and secrets rules.
- Trivy: dependency, container, repository, and configuration scanning.
- OpenSSF Scorecard: automated supply-chain and project-security checks.
- CVE Binary Tool: recurring checks for known vulnerabilities in software components.
Running every scanner on every event can create duplicate alerts and slow contributions. Start with the smallest layer that closes your largest gap, then add another scanner when it covers a different asset or provides a rule set you cannot maintain yourself.
#1 Best Overall
What “AI-powered” means in security scanning
AI-assisted coverage is narrower than the label suggests
GitHub explicitly describes an AI-based scanning engine for languages and frameworks outside CodeQL coverage. That is a specific capability, not proof that every GitHub finding is generated by an LLM or that AI covers every language equally.
The NIST catalog describes Snyk Code as using machine-learning-based semantic analysis. Its availability and free-tier terms are subject to the provider’s current program rules, so verify the live plan and licensing pages before treating it as a free option for a particular project.
The cited descriptions for Semgrep, Trivy, CodeQL, OpenSSF Scorecard, and CVE Binary Tool primarily describe static analysis, pattern or rule matching, automated checks, and vulnerability databases. They should not be presented as generative-AI products merely because they can detect security defects automatically.
What the benchmark evidence does—and does not—show
A 2025 benchmark study evaluated CodeQL and Snyk Code alongside large language models and other industry tools. It demonstrates that LLM-based vulnerability detection is being tested, but it does not establish a universal winner across languages, codebases, or vulnerability classes. Detection rate, false-positive rate, language support, remediation quality, runtime, and data-handling policy all affect the result. Treat a benchmark as one piece of evidence, not as a guarantee for your repository.
Comparison of the free and open-source options
| Tool | Best fit | Free or open-source position | AI qualification |
|---|---|---|---|
| GitHub code scanning / CodeQL | GitHub pull requests and repository workflow | Code scanning for public repositories is documented as free; advanced features vary by plan | GitHub documents an AI-based engine for some languages and frameworks outside CodeQL coverage |
| Semgrep | Custom SAST, secrets, and portable CI rules | Open-source CLI; the AppSec Platform has free and paid tiers | Primarily rules and pattern analysis in the cited project description |
| Trivy | Repositories, dependencies, containers, and configuration | Open-source CLI intended for developer machines and CI | Primarily vulnerability-database and scanner workflows |
| OpenSSF Scorecard | Project governance and supply-chain risk signals | OpenSSF project | Automated checks, not presented as an LLM scanner |
| CVE Binary Tool | Known-vulnerability and supply-chain monitoring | OpenSSF-listed project | Vulnerability scanning, not presented as generative AI |
There is no directly comparable accuracy, speed, or vulnerability-count figure for all five tools in the authoritative material available for this guide. Do not convert their different purposes into a single leaderboard.
GitHub-native projects: enable CodeQL first
Why it is the baseline
GitHub code scanning is the shortest path from a public repository to repeatable static analysis. GitHub says public-repository code scanning is available at no charge and can run with CodeQL or a third-party analysis tool. Findings appear in the repository security experience and can be associated with pull requests, so maintainers can address defects before merging.
GitHub’s free code security risk assessment is documented to scan up to 20 repositories. It reports vulnerabilities, severity, and potential Copilot Autofix counts. GitHub also states: “You won’t be charged for any GitHub Code Security licenses, and the GitHub Actions minutes used during the scan are provided at no cost.” The limit and included reports are features of that assessment, not a promise of unlimited private-repository scanning.
Recommended Free Tools
Rank #2
Implementation sequence
- Confirm repository scope. Make sure the project is public if you are relying on the documented free public-repository entitlement. Review organization policies if the repository belongs to an organization.
- Open the repository’s code-security settings. In GitHub, go to the repository’s Settings and the code-security or code-scanning area. Enable the CodeQL workflow offered for the languages detected in the repository.
- Review the generated workflow. Check which branches and pull-request events trigger analysis, whether the workflow has permission to upload results, and whether generated or vendored directories should be excluded.
- Run the first scan before changing policy. Let the initial analysis establish the finding types and severity distribution. Avoid making every alert a merge blocker until maintainers have triaged the baseline.
- Fix or suppress deliberately. Correct genuine defects, document accepted risk, and keep suppressions narrow. A suppression that covers an entire directory can hide future regressions.
- Revisit language coverage. If a language or framework is outside CodeQL’s coverage, consider GitHub’s documented AI-based engine where available or add Semgrep for a portable ruleset.
Where CodeQL alone is insufficient
CodeQL is a source-code analysis layer. It does not replace dependency, container, configuration, secrets, or project-governance checks. A repository that builds a container, downloads packages, or publishes binaries needs additional controls. Add those controls by asset type rather than duplicating the same source-code query in several tools.
Semgrep for custom rules and multi-CI portability
What the open-source CLI covers
Semgrep’s project documentation describes an open-source command-line interface with security uses including static application security testing, software-composition analysis, and secrets scanning. The CLI can run in a developer checkout or in a continuous-integration job, which is useful when contributions are mirrored across GitHub Actions and another CI service.
The AppSec Platform is a separate offering with free and paid tiers. Do not assume that a capability shown in the hosted platform is included in the open-source CLI. Check the license and feature boundary for the exact rule pack and reporting workflow you plan to use.
When Semgrep is the better second scanner
- Organization-specific patterns: write a rule for an unsafe API, a forbidden cryptographic mode, or a project convention that a general query pack does not know.
- Portable CI: keep the same scanner invocation when the project moves between hosted CI providers or also offers a local pre-commit check.
- Secrets as a separate signal: report exposed tokens and credentials independently from code defects so rotation work is not buried in SAST results.
- Controlled rollout: begin in reporting mode, tune noisy rules, and then enforce only the severities the maintainers can remediate consistently.
Keep Semgrep findings distinct from dependency findings in dashboards and pull requests. A vulnerable package, a hard-coded secret, and an injection path have different owners and response times even when one product can scan for all three.
Trivy for dependencies, containers, and configuration
What the repository scan does
Trivy’s documentation says trivy repo is designed to scan code repositories and is intended for local or remote repositories on a developer’s machine or in CI. This makes it useful for a checkout-wide pass that complements source-code queries.
Use Trivy when the project’s exposure comes from package manifests, lockfiles, container images, infrastructure configuration, or a combination of those assets. Its vulnerability-database workflow is different from CodeQL’s semantic analysis, so adding it can reveal issues that a source query cannot see.
A practical Trivy placement
- Run on pull requests that change manifests or build files. This keeps feedback close to the dependency or configuration change that caused it.
- Run on the default branch on a schedule. A package can receive a new CVE after the last code change; scheduled scans catch that drift.
- Scan release images or artifacts. A clean source tree does not prove that the built container is free of vulnerable operating-system packages.
- Route results by type. Dependency and image findings usually belong with maintainers or release engineers, while source findings go to the code owner.
Trivy is complementary rather than a direct CodeQL replacement. Installing both is sensible when the project ships software assembled from third-party components.
OpenSSF Scorecard and CVE Binary Tool for supply-chain risk
OpenSSF Scorecard
OpenSSF describes Scorecard as a set of automated checks for security risks in open-source projects. It examines project practices and supply-chain signals rather than trying to prove that every function is free of a particular vulnerability. Use its output to improve controls such as review discipline, branch protection, dependency updating, and release hygiene.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Scorecard is especially valuable for a project consumed by others. A maintainer can publish its results as evidence of process maturity, then use low-scoring checks to prioritize governance work that a code scanner cannot perform.
CVE Binary Tool
OpenSSF lists CVE Binary Tool as a project for regular vulnerability scanning and early warning about software-supply-chain risk. It is suited to monitoring known vulnerabilities in binaries and components over time. Pair it with Trivy or another dependency scanner when the project’s release process includes compiled outputs or bundled third-party code.
Neither Scorecard nor CVE Binary Tool is presented as a generative-AI scanner. Their value is coverage: one assesses project practices, while the other helps identify known component vulnerabilities.
Build a layered free scanning pipeline
Layer 1: source-code defects
Enable CodeQL for a public GitHub repository. Add Semgrep rules when you need a language pattern, framework check, or organization-specific policy that the first layer does not supply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsLayer 2: secrets and dependencies
Use Semgrep’s documented secrets capability or another dedicated secret check, and run Trivy against repositories and dependency manifests. Treat a suspected credential as an incident: revoke or rotate it first, then remove it from history and fix the source of the leak.
Layer 3: build and deployment assets
Run Trivy against container images and configuration files used to deploy the project. Keep this layer tied to the build or release job so a source-only pull request does not wait for an unrelated image scan.
Rank #4
Layer 4: project and supply-chain posture
Run OpenSSF Scorecard on a schedule and after major repository-policy changes. Run CVE Binary Tool regularly against released or built components. These scheduled checks catch drift that a pull-request-only pipeline misses.
Layer 5: triage and enforcement
- Establish ownership. Assign source findings to code owners, dependency findings to maintainers or release engineers, and governance findings to the project administrators.
- Set severity rules. Block merges only for findings that have a clear owner, a reliable signal, and a realistic remediation path.
- Track accepted risk. Record why a finding is suppressed, what compensating control exists, and when the decision should be revisited.
- Measure noise. If contributors routinely dismiss a rule, tune or remove it instead of teaching them to ignore the entire scanner.
How to verify an “AI” claim before adopting a scanner
- Identify the engine. Is the advertised feature an AI-based engine, machine-learning semantic analysis, a deterministic rule set, or a vulnerability database?
- Check language and framework coverage. An AI engine documented for languages outside CodeQL coverage may still support only a defined subset of frameworks.
- Understand data handling. Determine whether source code leaves the runner, whether prompts or findings are retained, and whether public-repository content is used for service improvement.
- Read the free-tier boundary. Confirm repository limits, scan frequency, private-versus-public eligibility, hosted-platform requirements, and whether CI minutes are included.
- Inspect the output. Require file and line locations, severity rationale, rule or query identity, and a way to suppress a proven false positive without hiding unrelated findings.
- Use benchmarks carefully. A result from one language, vulnerability class, or curated dataset does not predict performance on every open-source project.
Common failure modes and fixes
Duplicate alerts from overlapping scanners
CodeQL and Semgrep may flag the same insecure pattern, while Trivy reports the dependency that made the pattern exploitable. Deduplicate in triage, not by disabling an entire tool. Keep the alert whose context and remediation guidance are clearest, and link the others internally if your tracking system supports it.
False positives erode contributor trust
Start new rules in audit mode, review representative findings, and narrow the rule to the framework or data flow that matters. A smaller, trusted ruleset produces better security outcomes than a large ruleset that contributors routinely silence.
Scans miss generated or packaged code
Document which generated directories, vendored libraries, artifacts, and container layers are included. Excluding generated code can reduce noise, but it also creates a blind spot if generated output is shipped without an independent scan.
Scheduled scans are forgotten
Pull-request checks cannot detect a new CVE in an unchanged lockfile. Keep Trivy and CVE Binary Tool on a recurring schedule, and review Scorecard after repository-policy changes.
Free does not mean unlimited
Public-repository eligibility, repository-count limits, hosted-platform tiers, and CI-minute policies differ. GitHub’s documented risk assessment limit is up to 20 repositories, while other tools separate an open-source CLI from a hosted platform. Confirm current terms before designing a large organization-wide rollout.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Recommended starting configurations
Small public GitHub library
Enable CodeQL, review every high-severity result, and add Trivy for the package manifests. Run Scorecard on a schedule so project-governance gaps do not remain invisible.
Polyglot project using more than one CI provider
Keep CodeQL in the GitHub workflow and add Semgrep’s open-source CLI with a shared rule configuration. Use Trivy in the CI job that builds releases, then run CVE Binary Tool against the resulting components.
Containerized service with frequent releases
Use CodeQL for application paths, Trivy for repository and image scanning, and scheduled dependency checks. Add Semgrep when framework-specific patterns or secrets scanning require custom rules.
High-trust foundational project
Use all four layers: CodeQL and Semgrep for source, Trivy for dependencies and images, and Scorecard plus CVE Binary Tool for supply-chain oversight. Define ownership before enabling merge blocking so findings receive timely responses.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBottom line
For most public GitHub repositories, CodeQL is the right free first step. Semgrep extends coverage with portable custom rules; Trivy finds dependency, container, and configuration risk; OpenSSF Scorecard and CVE Binary Tool address project trust and known supply-chain vulnerabilities. Call a scanner AI-powered only when its documented engine, coverage, data handling, and free limits justify that description.
Frequently Asked Questions
Is CodeQL free for an open-source GitHub repository?
GitHub documents code scanning for public repositories at no charge. Advanced capabilities and private-repository terms vary by plan.
Can Semgrep replace CodeQL?
Semgrep can replace or supplement a source scanner when you need portable CI execution or custom rules. Many projects use it alongside CodeQL because their rule sets and workflows differ.
Does Trivy perform static application security testing?
Trivy is primarily documented for repository, dependency, container, and configuration scanning. Use a source-analysis tool such as CodeQL or Semgrep for application-code queries.
Free tools Windows power users keep installed
One-click scans. No signup required.
Are OpenSSF Scorecard and CVE Binary Tool AI scanners?
They are documented as automated checks and vulnerability-scanning projects, not as generative-AI scanners.
What should I scan on a schedule instead of only on pull requests?
Run dependency and component checks such as Trivy and CVE Binary Tool regularly, and rerun OpenSSF Scorecard after major repository or release-process changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
