The ongoing Developer tier includes 3 users, 5 config syncs and 3-day audit activity logs. Each extra developer is $8/month. The separate Team tier has an introductory 14-day premium trial; do not classify that trial as expiry of Developer Free.

No credit card is needed to sign up for Free, but custom domains require card verification. Free includes limited tenant and connection features; higher production limits and additional organizations are on paid plans. MAU quota is not an unlimited user allowance.

MRU counts retained users, not the same as monthly active users (MAU). Hobby needs no card; it has 1-day application-log retention, fixed 7-day sessions and limited impersonation. B2B add-on Free supports 100 monthly retained organizations with up to 20 members each; paid SSO/advanced controls are separate.

Turnstile Free can protect production websites, including small and medium businesses, independently of other Cloudflare services. Analytics lookback is limited to 7 days. Custom-branding removal, any-hostname widgets and ephemeral IDs are Enterprise-only; Free supports pre-clearance.

Hosted in AWS Frankfurt; webhooks, Admin API, custom SMTP and team invites require Pro; repeated overage prompts upgrade. Commercial-use terms for cloud Free not independently confirmed.

Designed for individuals and personal projects; verify business usage terms.

Designed for individual developers and small teams; private-repository scan quotas are enforced and recurring free-plan scans run weekly; commercial-use terms not explicitly confirmed.

Community is Free Forever for up to 1.000 MAU and 20 tenants. The 14-day audit-log retention advertised on the provider's payment comparison is a Pro feature, not a verified Community allowance; do not assume it is included in Free. Enterprise compliance, SSO and premium support require separate terms. Commercial-use rights remain unconfirmed.

Rescans every 3 days; premium PR security review, integrations, and extended coverage require paid tiers. Commercial-use terms not independently confirmed.

Token allowance and app limits apply; additional organization and advanced auth features require paid plans.

You run the identity server and database; secure TLS, upgrades, backups, and availability. Vendor hosting and enterprise support are not included.

Requires deployment, database, backups, and operational management. Verify current community-versus-cloud feature and license conditions.

Host the application and its supporting services yourself; configure secure access and backups. Enterprise features or managed offerings may cost extra.

Requires an identity backend, reverse-proxy integration, and ongoing security maintenance. Hosting and delivery of external MFA messages are separate.

You administer credential security, encryption keys, backups, TLS, and updates. It is not the paid or managed Bitwarden cloud service.

The initial 15-day trial transitions to a capped ongoing Free plan. The current pricing page highlights paid Individual/Startup tiers; Free feature entitlements, card requirements and commercial-use rights are not separately specified. Do not assume paid-plan features or that usage above the cap is free.

A payment card is required before using a production environment; staging can be tested without a card. Enterprise SSO and Directory Sync cost from $125 per connection/month, custom domains $99/month, and each additional 1 million MAUs $2.500/month. Avoid paid features and overages.

Self-hosted only: operate and secure your own servers, database, upgrades, backups and identity integrations; hosting, SMS/email and infrastructure may cost extra. Casdoor Cloud is paid after its time-limited trial/credit; do not confuse with the perpetual self-hosted edition.

Requires your own hosting, security updates and operations. Cerbos Hub PoC has separate hosted limits (100 monthly active principals); Hub collaboration, managed policy delivery, enterprise features and support are not included.

Requires self-managed infrastructure, secure TLS, unsealing, key recovery, access policies and backups; hosting/operations cost extra. MPL-2.0 source distribution obligations apply to modified covered files.

Provide and secure your own compute, persistent database, backups, TLS, monitoring and availability. In-memory storage is for development; use PostgreSQL or MySQL for production. Managed authorization offerings and infrastructure cost extra.

Dex federates to upstream identity providers rather than replacing user directories; configure TLS, secure token signing keys, storage and identity connectors yourself. Upstream identity services and hosting may charge separately.

Requires your own infrastructure, database, UI and email/SMS services; Ory Enterprise License is separate for enterprise features, guaranteed security patches, support and SLAs. Not the hosted Ory Network plan.

Requires a separate login/consent application, database and your own infrastructure. Ory recommends an enterprise agreement for business-critical deployments needing guaranteed CVE fixes, SLAs and advanced features; managed Ory Network is separate.

MIT-licensed software; requires compatible OAuth2/OIDC provider, correct proxy/cookie configuration and self-managed infrastructure; identity-provider charges may apply.

Detection can produce false positives and miss secrets; configure rules and review findings. Local scanning requires your own compute/CI infrastructure; hosted enterprise monitoring, if used, is separate. Found credentials must be revoked or rotated, not merely removed from Git.

Policy authoring, testing, enforcement integration and hosting are operator responsibilities; OPA makes policy decisions but the calling service must enforce them. Managed policy platforms are separate.

Requires host or cluster privileges and compatible kernel event collection; rule tuning, alert delivery, retention, SIEM integrations and infrastructure are operator-managed. Managed security services may charge separately.

Self-hosted infrastructure, storage, updates and security operations are required. Components have GPLv2/Apache-2.0 licensing obligations; the separately managed Wazuh Cloud offering is a trial or paid service.

Requires your own compute, network access and vulnerability database updates; scanning results depend on available advisory data and require human triage. Hosted security services and optional integrations may be separately priced.

Operate TLS, DNS, IdP, certificates and deployment infrastructure yourself. Pomerium Zero managed control plane and Pomerium Enterprise governance features are separate offerings with their own terms and fees.

Requires operating your own SpiceDB instance, datastore and authentication/authorization integration; infrastructure, backups, monitoring and optional AuthZed managed services are separate costs.

Passkeys are required (no password fallback); deploy and secure your own server, HTTPS, backups and identity configuration. Hosting costs are not included.

Self-hosting requires your own infrastructure and operational security; LDAP gateway is read-only, and deployment/replication require configuration. MPL-2.0 obligations apply.

Free open-source CA lacks several commercial Smallstep features, including turnkey multi-CA, high-availability and enterprise support; manage private keys and infrastructure yourself.

Requires your own PHP/database server, TLS, email setup, backups and security updates. Cloud-hosted Passbolt is a separate paid service with only a short trial; paid enterprise capabilities are excluded. AGPL-3.0 source and trademark conditions apply.

Bring your own server, networking and storage; secure WAF configuration, rule tuning, updates and operations remain your responsibility. Professional support and managed infrastructure are separate; AGPL-3.0 obligations apply.

This is optional managed infrastructure, not free hosting for your application or database. Starter is intended for evaluation and side projects; production-oriented features and longer retention require Pro. Card and commercial-use terms are not explicit.

Only scan targets you own or are authorized to assess; active scans can disrupt applications. Local hardware and any commercial support are not included.

Vulnerability database and target downloads need network access; findings depend on database freshness. Anchore Enterprise and commercial support are separate paid offerings.

Requires a compatible self-managed host, log access and firewall integration; server costs and ongoing security administration are not included. GPL redistribution obligations apply.

Cloud KMS providers may charge for key operations; local age/PGP encryption avoids paid KMS. Safeguard private keys and plaintext, including CI logs and temporary files. MPL-2.0 redistribution obligations apply; SOPS does not provide hosted key management.

Only scan assets you own or are explicitly authorized to assess. Treat third-party templates as untrusted checks; some may execute scripts or use headless browsers. Update the scanner/templates and throttle requests to avoid disruption. Hosted ProjectDiscovery services and CI compute are separate.

Run locally or in your own CI; CI compute and storage may cost extra. Online scans query OSV.dev/deps.dev with dependency metadata; offline mode needs downloaded databases. Guided remediation can execute package-manager scripts.

Semgrep-maintained rules have separate rules-license restrictions on competing SaaS and some commercial redistribution; LGPL engine license differs from rule licenses. Pro engine, supply-chain and secrets detection, hosted management and CI resources may cost extra.

Stores the vault locally; you must handle backups, device synchronization, recovery and security updates. No hosted password-sync service is included. GPL redistribution obligations apply to modified/distributed builds; hardware keys and optional cloud sync providers can cost extra.

Android app runs locally and does not provide managed authentication hosting or cross-device cloud sync; backup and recovery are your responsibility. GPL-3.0 redistribution obligations apply; compatible with standard TOTP/HOTP services.

Runs on your own computer or CI runner; compute, CI and container registry costs are separate. Syft generates SBOMs rather than performing a full vulnerability assessment; Anchore commercial support is optional.

Requires a compatible Linux kernel and privileges for eBPF, with Kubernetes/host operations and telemetry storage paid by the operator; security policies need careful testing.

This is the free Checkov CLI, not the paid Prisma Cloud platform. CI runner, cloud accounts, remote integrations and third-party services may cost money; findings require manual review and remediation.

Requires your own Linux/Windows/Docker/Kubernetes infrastructure, log access, remediation integrations and security operations. Premium threat intelligence, paid blocklists and CrowdSec Console premium features are not included.

The free local scanner does not include Lynis Enterprise dashboards, centralized reporting, commercial support or host infrastructure; audits require suitable system permissions and operator review.

Run the agent and queries on your own endpoints; fleet management, centralized log storage, compute and commercial SaaS services are separate. Endpoint access and security permissions must be managed by the operator.

The free KICS CLI is separate from paid Checkmarx products. Self-managed CI runners, cloud resources, third-party services and remediation work can cost money; findings need review.

Requires vulnerability data downloads and Java 11+. An NVD API key is strongly recommended due to rate limits; optional Sonatype OSS Index/Guide analyzers require credentials and may have separate commercial terms. CI runners and infrastructure cost extra.

Requires your own machine and authorized cloud credentials. Provider API usage, log/storage and cloud resources can incur charges; Prowler Cloud managed platform and support are separate paid offerings. Review IAM permissions and scan impact.

Runs on your own workstation or CI and requires appropriate cluster access for live scans. Kubernetes compute, image registries and security feeds can incur separate costs; ARMO hosted services/support are not included. Use fix/patch commands only after review.

Requires your own Kubernetes/OpenShift cluster and operational maintenance; issuer or CA rate limits and charges may apply, as may DNS, infrastructure and support. Not a hosted certificate service.

Runs locally or on user-provided CI runners. GitHub Actions runner minutes may cost money; optional GitHub code-scanning/SARIF upload can require GitHub Advanced Security for private repositories, but CLI scanning does not. This is not a hosted free security scanning service.

Requires self-operated Kubernetes, compute, networking, DNS and storage, which can incur charges. Cluster/server components are AGPL-3.0, clients Apache-2.0; comply with AGPL network-use/source obligations. Enterprise-only features and alternative commercial licensing are separate paid offerings; no vendor-hosted free infrastructure is included.

Requires operator-provided server, network and WireGuard infrastructure. AGPL obligations apply to the open-source core; the enterprise directory and enterprise-only features are separately licensed. The paid Business/Enterprise offerings must not be confused with the free open-source core; consult official feature boundaries before deployment.

Production requires HTTPS, PostgreSQL, and configured Cloudflare Email Service and Twilio credentials for transactional email/SMS; provider messaging and infrastructure may incur charges. Redis recommended for multiple instances. No free hosted infrastructure included.

Runs on infrastructure you operate; server, database, backups, TLS, email delivery and maintenance may cost money. Intentionally does not implement all LDAP server features, and GPL-3.0 obligations apply to redistribution; no hosted free account or commercial support is included.

Self-operated server, database, HTTPS, support and hardware/SMS/email delivery are not free. Some separately distributed integration plugins have user-count or subscription limits (including Windows Credential Provider and ADFS); AGPL-3.0 network-source obligations apply to modified deployments.

You must supply and secure your own host, TLS, backups, outbound email and any external dependencies; infrastructure is not free. Professional support is paid. LOCAL_TEST mode uses an unsafe demo configuration and must not be used in production.

Self-hosted software only; provide your own compute, PostgreSQL, Redis, storage, HTTPS, backups and security maintenance. Vulnerability database updates and third-party scanner dependencies require network/resources; no free managed hosting is included.

Requires a compatible AI coding agent and an existing VPS; compute, model/API usage, backups and alert services are not included. Runs privileged server changes; review commands, retain console access and snapshots. Not a free hosted VPS.