Socket

What it is for

Socket is a hosted dependency-security desk: you open Scans, and Free is $0 per dev seat / month. Use it when the job is malware and CVE alerts on the packages you install, not when you need a $20 chat seat.

What makes it unique: the cover is the official Socket Scans list (socketdev-demo org, javascript-threats / postman / python-threat / hw_gha_action rows with branch, pull-request, and commit columns) from the docs still — not a pricing card. The rows themselves are ops of Scans. Socket bills per dev seat, not a chat seat.

Key features

• Scans — a repository / PR / commit you run through Socket (cover still; docs). One scan. Cover javascript-threats / hw_gha_action rows and the Ran-at column sit here. Free prints 1,000 scans / month.
• Alerts — a finding you triage (known malware, CVE, supply-chain) (alerts still; docs). An alert, not a scan. Cover-adjacent 151 alerts and Critical CVE rows sit here.
• Repositories — a GitHub (or other) repo you connect so scans keep landing (cover socketdev-demo/*; docs). A repo, not an alert. Overview 20 repositories sit here.
• Dependencies — the package graph those repos resolve (overview still). A graph, not a repo. Overview 66,540 dependencies sit here.
• Security policies — the rules that score, ignore, or block an alert (official video; docs). A policy, not a dependency. Auto-block malicious dependencies on Free sit here.

The CLI / API / SDK is install. Free / Team / Business tiles are the meter. Overview charts are ops of Scans / Alerts / Repositories. Slack security alerts print on Team — a notify option, not a sixth desk.

Who it's for

Best fit: app teams who will stay on Free at $0 / dev seat / month (1,000 scans) while they open a first Scans list, then buy Team at $25 / seat / month when they want reachability scoring and Slack alerts.

Pricing

Verified 2026-10-23 (Asia/Shanghai) from socket.dev/pricing. Monthly / Yearly (save 20%) toggle. Tiles print Free $0 / Team $25 / Business $50 per dev seat / month. Enterprise Contact Sales.

• Free — $0 / dev seat / month. 1,000 scans / month. 500 API requests. Attack coverage 2. 70+ risk types, auto-block malicious dependencies, AI-powered risk analysis.
• Team — $25 / dev seat / month. 5,000 scans / month. Reachability analysis, risk-based priority scoring, Slack security alerts. Yearly −20%.
• Business — $50 / dev seat / month. Compliance integrations (e.g. Vanta), SBOM import & export, SSO/SAML + webhooks, GitHub Actions and AI-model scanning. Yearly −20%.
• Enterprise — Custom. Function-level reachability; GitLab / Bitbucket / Azure DevOps. Do not invent an Enterprise dollar.

Confirm checkout; taxes follow your location.

Limitations / costs

• Free is 1,000 scans / month and 500 API requests. A busy monorepo week still invoices Team at $25 / seat.
• Reachability and Slack alerts print on Team, not Free. The Scans list looks the same; the scoring ceiling is not.
• A dependency-security desk, not a secrets vault. For Infisical’s $0 / 5-identity secrets see Infisical. For Semgrep’s SAST rules see Semgrep.

Alternatives

• Aikido — broader AppSec when you want SAST + containers on one tile, not Socket’s package-malware desk.
• Semgrep — SAST / secrets rules when the finding is in your code, not an npm/PyPI tarball.
• Infisical — secrets + PAM when the risk is a credential, not a dependency.

Official tutorial

Official Socket Security channel video: Socket Demo Video Triaging Alerts & Security Policy Configuration (oEmbed author: Socket Security). First-party product walkthrough; the Scans list still is the cover. Policy on the video is ops of Security policies, not a second listing.

Written path: socket.dev/pricing plus the Scans still.

Website

https://socket.dev

Repository

https://github.com/socketdev

Source

Catalog row curated for AI Tools Nav. Cover is the official Socket Scans list from the docs still. Dollars checked on socket.dev/pricing (Free $0; Team $25/seat/mo; Business $50/seat/mo; yearly −20%). Tutorial oEmbed author: Socket Security.

Last verified

2026-10-23 (Asia/Shanghai) editorial check.