Stop guessing which one. Put them side by side.

The grid says what these tools are. This says what builders did about it — one decision per person, changeable whenever you change your mind.

# Tool comparison — Socket.dev vs Dependabot vs Gitleaks

Source: Kbaise, a directory of tools that work with Lovable projects.
Pick one and tell me why before writing any integration code.

## Socket.dev (socket-dev)
- URL: https://socket.dev
- Category: Code review, testing & security
- Cost: mixed — Free $0: 1,000 scans/mo, 3 members, 1 repository label; Team $25/dev/mo with a 5-developer minimum; Business $50/dev/mo with a 20-developer minimum; Enterprise custom; free Team accounts for open source on request
- What it is: Inspects what a package actually does rather than only matching published CVEs, detecting 70+ risk types including install scripts, unexpected network or filesystem access, obfuscated code, typosquats and outright malware. It comments on the pull request when a dependency change introduces new capabilities. Higher tiers add reachability analysis to cut CVE noise.
- Why builders pick it: This is the direct answer to AI package hallucination and slopsquatting. When your agent adds a convincing-sounding package published last week that phones home on install, Socket blocks the pull request.
- Trap: Team carries a 5-developer minimum, a $125/mo floor, and Business a 20-developer minimum, so small teams pay for seats that do not exist.
- Wiring: Install the Socket GitHub App for PR comments, or run npx socket in CI
- Full dossier: /api/public/tools/socket-dev

## Dependabot (dependabot)
- URL: https://docs.github.com/en/code-security/dependabot
- Category: Code review, testing & security
- Cost: free — $0 on all GitHub repositories, public and private, including private repos on the free GitHub plan
- What it is: GitHub-native bot with three jobs: alerts for vulnerable dependencies drawn from the GitHub Advisory Database, security updates that automatically open pull requests bumping to a patched version, and scheduled version updates configured in .github/dependabot.yml. Grouped updates and auto-merge rules keep pull request volume manageable.
- Why builders pick it: Zero-cost, near-zero-config baseline. The package.json your agent wrote will drift into known-CVE territory within months, and this is the one tool that quietly fixes it while you sleep.
- Trap: It only knows advisories already published to GitHub's database, so brand-new malicious packages slip through; pair it with Socket. It also skips archived repos, and ungrouped updates get spammy fast.
- Wiring: Enable under repo Settings > Code security, then add .github/dependabot.yml
- Full dossier: /api/public/tools/dependabot

## Gitleaks (gitleaks)
- URL: https://github.com/gitleaks/gitleaks
- Category: Code review, testing & security
- Cost: free — $0 forever, MIT open source; the official GitHub Action needs a free license key for organisation-owned repos, none for personal accounts
- What it is: Scans git repositories, loose files and stdin for passwords, API keys and tokens. It walks full commit history using git log -p, so it finds credentials in old commits that were later deleted from the working tree. Runs as a CLI, pre-commit hook, Docker image or GitHub Action.
- Why builders pick it: The highest-value five-minute install on this list. An assistant pasting a live OPENAI_API_KEY or database URL into a committed config file is routine, and once pushed only history rewriting removes it.
- Trap: Entropy-based detection false-positives on hashes, lockfiles and test fixtures, so budget time for a .gitleaksignore baseline. The maintainer has declared it feature complete, security patches only.
- Wiring: brew install gitleaks && gitleaks detect --source .
- Full dossier: /api/public/tools/gitleaks

## Quick read

- Free with no card: Dependabot, Gitleaks.

## Rules
1. Prefer the free tier when no budget was stated, and say what the ceiling is.
2. Read the full dossier before integrating.
3. Fetch /api/public/models before writing any AI model ID.

Agents can fetch the same thing: GET /api/public/compare?slugs=socket-dev,dependabot,gitleaks