Hasp Alternatives
Similar projects and alternatives to hasp
-
dagger
Automation engine to build, test and ship any codebase. Runs locally, in CI, or directly in the cloud (by dagger)
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
-
-
-
leakferret
MCP-native secret scanner in one fast Rust binary: engine, CLI, and MCP server. Finds API keys and secrets, skips known-public fixtures, verifies live keys with a real provider call, and applies env-var rewrites. Privacy invariant: the raw secret never leaves disk.
-
hakoniwa
Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.
-
sandbox-shell
macOS Seatbelt sandbox CLI for developers. Protect credentials (SSH, AWS, GPG) from malicious npm packages, supply chain attacks, and untrusted build scripts. Deny-by-default filesystem isolation. Perfect for Claude Code agentic workflows with --dangerously-skip-permissions.
-
aegis
Supply-chain security scanner for npm packages. Detect malicious code, typosquatting, and compromised dependencies before you install them. (by z8run)
-
cache-commander
Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, reclaim disk space. Supports pip, npm, Cargo, HuggingFace, Homebrew, and more.
hasp discussion
hasp reviews and mentions
-
GitHub Actions is the weakest link
Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection.
I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp
Instead of just statically parsing YAML it hooks into the runner env itself. Some of its runtime checks mirror what zizmor already does including resolving upstream SHAs to canonical branches (no impostor commits) and traversing the transitive dependency tree. I have a PR up with a comparison document here (hasp vs. zizmor): https://github.com/electricapp/hasp/pull/13/changes#diff-aab...
Furthermore, it sandboxes itself to prevent sensitive exfiltration by acting as a token broken which injects the secret at runtime -- the GH token can only ever be used to call the GH API. It uses landlock, seccomp, and eBPF via Rust, so no docker. The token broker sandbox can also be used to wrap a generic executable; hasp has generic applications beyond GHA as well (i.e. agentic or other contexts, where token runtime injection seems quite in vogue)
I'm using this as a stopgap until GH rolls out some of the features on its roadmap. I'm moving torward treating the runner as a zero-trust or actively malicious environment, so this was my small contribution on that front.
Stats
electricapp/hasp is an open source project licensed under MIT License which is an OSI approved license.
The primary programming language of hasp is Rust.
Popular Comparisons
Sponsored