89 products Sparkpulse tracks are shipping around security. The highest-velocity security products right now are Speakeasy, Bitbucket and Dapr (ranked by Sparkpulse's velocity score). The theme runs across 15 sectors, so the momentum you see here is drawn from products competing in different corners of the market. Their velocity scores span 5.0 to 10.0 out of 10, a spread that shows how unevenly shipping cadence is distributed across the field. Below: the products carrying this theme and 8 recent editorial briefs that reference it, the most recent dated Nov 4, 2026. Everything on this page is regenerated from verified release data, so the ranking reflects the latest changelogs rather than a static list.
#01SpeakeasySpeakeasy makes AI agents first-class principals: server identity modes, Slack as a work identity, and directory group role mapping10.0alternatives →#02BitbucketBitbucket Pipelines swaps stored credentials for step permissions and container tokens.6.3alternatives →#03DaprNine days after 1.19 GA, Dapr patches 11 security flaws across three release lines.6.3alternatives →#04DevinDevin's quarter is one long enterprise hardening push, headlined by stacked review permissions and network policy.6.3alternatives →#05Easy!AppointmentsEasy!Appointments 1.6 lands video conferencing, GDPR tools, and a serious security overhaul across its CalDAV and booking stack.6.3alternatives →#06CrowdSecCrowdSec's 1.8.2 candidates let operators write their own bot fingerprints.5.0alternatives →#07CoderCoder now checks workspace app URLs on the server, a breaking fix sent to all three lines.5.0alternatives →#08Read the DocsRead the Docs adds project-scoped API keys for uploading built docs.5.0alternatives →#09TwentyTwenty 2.58.1 stops existing accounts from joining a workspace through SSO alone.5.0alternatives →#10QuayQuay patches three supported lines on one afternoon, mostly CVE bumps.5.0alternatives →#11PixelfedPixelfed 0.15.2 ships the PHP RCE patches and turns cached timelines on for everyone.5.0alternatives →#12ResendResend now auto-revokes its API keys found leaked in public Docker images and datasets.5.0alternatives →#13Parse ServerParse Server's alphas close an account-takeover bug and open 9.12 with Keycloak audience checks.5.0alternatives →#14EGroupwareEGroupware's November release pairs critical security fixes with full Stalwart mail-server support.5.0alternatives →#15HoppscotchHoppscotch adds an enterprise cloud tier and an AI assistant, then turns to desktop trust.5.0alternatives →#16RoundcubeRoundcube patches its Sieve filters and CSRF checks in a sixth paired security release5.0alternatives →#17SOGoSOGo's 5.12.13 fixes its largest batch of vulnerabilities yet, some critical.5.0alternatives →#18ThingsBoardThingsBoard closes a script-sandbox file write and dozens of CVEs on its 4.3 and 4.2 lines.5.0alternatives →#19FreshRSSFreshRSS ships two security releases in a day for PHP CVEs and moves Docker to Debian 13.5.0alternatives →#20CountlyCountly's two LTS lines now get the same security fixes within a week of each other.5.0alternatives →#21CodyCody rebuilds its login, adds a Sales Report and speeds up pages ahead of peak season.5.0alternatives →#22HorillaHorilla shipped six security releases in three weeks, ending with a no-login RCE.5.0alternatives →#23NGINXnginx patched HTTP/3 twice in a month and is trimming old platform code on mainline.5.0alternatives →#24TraefikTraefik v3.8 rc.1 is a Gateway API release; v2.11 keeps getting security patches.5.0alternatives →#25WildFlyWildFly 42 brings virtual threads to Jakarta Concurrency.5.0alternatives →#26ActivepiecesActivepieces patches an unauthenticated webhook crash of its API on the 0.92 line.5.0alternatives →#27Open edXOpen edX closes a stored-script hole in course certificates on both supported release lines5.0alternatives →#28Google CloudGoogle Cloud is broadening Gemini Enterprise's data reach and tightening security defaults.5.0alternatives →#29WeaviateWeaviate patched its whole cloud estate in 17 hours after the eMudhra CA compromise.5.0alternatives →#30ElasticsearchOne Node.js Brotli bug and a compromised CA bundle force ten patches across the Elastic Stack.5.0alternatives →#31Open Web AnalyticsOpen Web Analytics 1.14.7 ships unspecified security fixes and a field-clearing command.5.0alternatives →#32HOMERHOMER 11 closes an open mTLS listener and stops dropping ISUP from SIP-I calls.5.0alternatives →#33ILIASILIAS keeps three major versions patched on the same day, month after month5.0alternatives →#34RailwayRailway lets other tools hand work to its cloud agents via MCP, the CLI or the API.5.0alternatives →#35Eclipse OpenJ9OpenJ9 follows its 0.63 CVE release with a notes-less 0.63.0.1 respin.5.0alternatives →#36AdGuard HomeAdGuard Home's 1.0 beta matches stable's security fixes and reworks client settings5.0alternatives →#37ScalarScalar's Agent Chat now asks before every API call and hides your saved keys.5.0alternatives →#38TailscaleTailscale makes a device's public IP a posture check, after three client security patches.5.0alternatives →#39HuginnHuginn closes a JqAgent leak of server secrets and outbound proxy bypasses.5.0alternatives →#40GravityKitGravityKit folds every GravityView extension into one Pro plugin.5.0alternatives →
Speakeasy, Bitbucket, Dapr, Devin, Easy!Appointments, and 35 more — the security products Sparkpulse tracks, ranked by shipping velocity from verified changelogs.
Which security product has the highest shipping velocity?
Speakeasy, with the top velocity score (10.0/10) — Sparkpulse's velocity score is derived from verified release data.
How many products are shipping around security?
Sparkpulse currently tracks 89 products carrying the security theme, updated continuously from verified release data.