Scandar and Socket
Socket is a hosted supply-chain firewall and scanner. Scandar reads the lockfile in the repository and opens a pull request.
Information verified on 25 October 2026; plans change, check their site.
| Scandar | Socket | Source | |
|---|---|---|---|
| Published price | Prices are whatever Polar is configured to sell on this server, shown on the pricing page. While payments are not set up, every feature is open and every limit is unlimited. The product has no per-developer price of its own. | The comparison table lists Free at $0, Team at $25, and Business at $50 per dev seat per month. Enterprise is custom. | Socket pricing Verified on 25 October 2026 |
| Dev seats | No seat count. People share a plan through an organization when that feature is on. | The comparison table lists 1 dev seat on Free, from 5 on Team, from 20 on Business, and custom on Enterprise. | Socket pricing Verified on 25 October 2026 |
| Scans per month | Public scans and signed-in scans use the limits in this app, not a third-party scan meter. | The comparison table lists 1,000 scans/month on Free, 5,000 on Team, and unlimited on Business and Enterprise. | Socket pricing Verified on 25 October 2026 |
| Reachability | Import and require reachability for the code it can read. Not function-level. | The comparison table lists reachability analysis as not included on Free and included from Team upward. Full app function-level CVE reachability is Enterprise only. | Socket pricing Verified on 25 October 2026 |
| Malicious packages | OSV advisories whose id starts with MAL- are shown first, with the instruction to remove the package. | The comparison table lists blocking malicious packages at install as included on every plan. | Socket pricing Verified on 25 October 2026 |
| SAST, secrets, containers | Not part of Scandar. | Under Socket Basics, the comparison table lists SAST languages and secret detectors as not included until Enterprise, where it lists 15+ languages and 800+ secret detectors. Public container registries are listed on Enterprise. | Socket pricing Verified on 25 October 2026 |
| Source code | The repository archive is downloaded so the scan can see which packages the code imports. | The pricing FAQ says source code never leaves your computer or your CI environment. Only the dependency list is sent to Socket. | Socket pricing Verified on 25 October 2026 |
| Open source and annual billing | The public package and CVE pages are free to read. Repository scans follow the limits above. | The FAQ says Socket is free for open source, and that paying annually saves up to 20% compared with monthly. A developer is someone who committed to a repository Socket scans, in the past 90 days. | Socket pricing Verified on 25 October 2026 |
Where Scandar fits
- A fix pull request lists each package, the version it moves from and to, whether the change is direct or an override, and the advisory ids. When an explanation is already cached, the pull request adds an “In plain words” section. Opening the page does not call the model.
- Priority uses whether the project imports the package, not only the severity on the advisory.
- One Node process you host. The scan reads the lockfile you already committed.
Where Socket does more
- The comparison table lists “block malicious packages at install” as included on Free, Team, Business, and Enterprise. Scandar flags OSV malware advisories; it does not sit in front of npm install.
- Reachability analysis is listed from the Team plan up, and full application function-level CVE reachability is listed on Enterprise only. Scandar stops at imports and requires.
- Their FAQ says source code never leaves your computer or your CI, and only the dependency list is sent. Scandar downloads the repository archive to see which packages are imported.
- Enterprise lists SAST (15+ languages), 800+ secret detectors, and public container registries. Scandar does not do those.
Which one to use
Choose Socket if you want a hosted firewall that blocks malicious installs, reachability beyond imports, or SAST, secrets, and containers on the Enterprise plan.
Choose Scandar if you want the fix written as a pull request on your repository, with the advisory explained in plain words when that text is already cached.