For one developer with a few repositories, free tooling covers the core: dependency alerts, update pull requests, an open vulnerability database scanner, and secret scanning. You mostly trade away cross-repository views, reporting, evidence for buyers and time. Add paid or platform tooling when those gaps start costing more hours than they save.
What free tooling does well
Your code host and open projects already do real work. GitHub Dependabot alerts report dependencies with known vulnerabilities, link each to the affected file and give a fixed version when available. Dependabot version updates open pull requests that keep dependencies current. OSV-Scanner connects your dependencies to the open OSV.dev database from the command line. The CISA exploited list is free and downloadable. For one person, that stack is a sound start.
What you trade away
| Gap | How it shows up |
|---|---|
| Cross-repo view | You check each repository by hand and miss the quiet one |
| Prioritisation context | Long lists with little help on what is called or exposed |
| Evidence and reporting | A buyer asks for proof and you rebuild it from screenshots |
| Policy enforcement | Rules live in your head, not in a gate that blocks a merge |
| Time | Glue scripts and manual checks eat your week |
Notice that none of these is about detection. Free tools find known issues well. The cost is your attention.
Signs it is time to add something
- You have more than a handful of repositories and cannot say which ones lack scanning.
- Customers send security questionnaires and you answer from memory.
- Alerts exceed what you read in your weekly block, and you have no way to rank them.
- A second person joins and you need roles and sign-off.
- You ship containers or APIs that your dependency alerts do not cover.
If none apply, stay free. Spending is not a security control.
How to evaluate a paid option without a long pilot
Run it on one real repository for two weeks. Count how many findings it reported that your free stack did not, how many you could close faster, and how long setup took. Ask what happens to your data if you stop using it. Ask for exports you can keep.
Keep the free layer even when you add more
Do not rip out Dependabot alerts or secret scanning because you bought something else. Overlap costs little and covers failure of either.
Quick check
Is a free scanner less accurate than a paid one?
Not necessarily. Both rely on advisory databases. Differences usually lie in context, coverage of ecosystems, workflow and support, so test with your own code.
What is the first paid feature worth considering?
Usually a cross-repository view with prioritisation, because it saves the most attention. Check it against your own list of gaps.
Safeguard provides dependency scanning, reachability analysis and a free scan at gold.safeguard.sh/scan if you want to compare results against your current stack.
Sources
- GitHub Docs, about Dependabot alerts
- GitHub Docs, about Dependabot version updates
- OSV-Scanner
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
