Stop guessing which one. Put them side by side.

The grid says what these tools are. This says what builders did about it — one decision per person, changeable whenever you change your mind.

# Tool comparison — Arcjet vs Dependabot vs Gitleaks

Source: Kbaise, a directory of tools that work with Lovable projects.
Pick one and tell me why before writing any integration code.

## Arcjet (arcjet)
- URL: https://arcjet.com
- Category: Code review, testing & security
- Cost: paid — No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial
- What it is: Security SDK that runs inside your application rather than at the edge, with adapters for Next.js, Node, Bun, Deno, SvelteKit, Remix, Astro, Fastify and NestJS. It provides rate limiting, bot detection, a shield WAF, email validation, PII redaction and prompt-injection detection, invoked per route as ordinary code.
- Why builders pick it: AI-generated API routes almost never carry rate limits, leaving a signup or LLM-proxy endpoint open to abuse and a surprise bill. A few lines per route caps it and blocks disposable-email signups.
- Trap: Priced per app plus per-request usage, and the free tier is gone as of 2026, so a multi-service project pays $25/mo for every service it protects.
- Wiring: npm install @arcjet/next
- Full dossier: /api/public/tools/arcjet

## Dependabot (dependabot)
- URL: https://docs.github.com/en/code-security/dependabot
- Category: Code review, testing & security
- Cost: free — $0 on all GitHub repositories, public and private, including private repos on the free GitHub plan
- What it is: GitHub-native bot with three jobs: alerts for vulnerable dependencies drawn from the GitHub Advisory Database, security updates that automatically open pull requests bumping to a patched version, and scheduled version updates configured in .github/dependabot.yml. Grouped updates and auto-merge rules keep pull request volume manageable.
- Why builders pick it: Zero-cost, near-zero-config baseline. The package.json your agent wrote will drift into known-CVE territory within months, and this is the one tool that quietly fixes it while you sleep.
- Trap: It only knows advisories already published to GitHub's database, so brand-new malicious packages slip through; pair it with Socket. It also skips archived repos, and ungrouped updates get spammy fast.
- Wiring: Enable under repo Settings > Code security, then add .github/dependabot.yml
- Full dossier: /api/public/tools/dependabot

## Gitleaks (gitleaks)
- URL: https://github.com/gitleaks/gitleaks
- Category: Code review, testing & security
- Cost: free — $0 forever, MIT open source; the official GitHub Action needs a free license key for organisation-owned repos, none for personal accounts
- What it is: Scans git repositories, loose files and stdin for passwords, API keys and tokens. It walks full commit history using git log -p, so it finds credentials in old commits that were later deleted from the working tree. Runs as a CLI, pre-commit hook, Docker image or GitHub Action.
- Why builders pick it: The highest-value five-minute install on this list. An assistant pasting a live OPENAI_API_KEY or database URL into a committed config file is routine, and once pushed only history rewriting removes it.
- Trap: Entropy-based detection false-positives on hashes, lockfiles and test fixtures, so budget time for a .gitleaksignore baseline. The maintainer has declared it feature complete, security patches only.
- Wiring: brew install gitleaks && gitleaks detect --source .
- Full dossier: /api/public/tools/gitleaks

## Quick read

- Free with no card: Dependabot, Gitleaks.

## Rules
1. Prefer the free tier when no budget was stated, and say what the ceiling is.
2. Read the full dossier before integrating.
3. Fetch /api/public/models before writing any AI model ID.

Agents can fetch the same thing: GET /api/public/compare?slugs=arcjet,dependabot,gitleaks