Repository Index

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting

Go security checker

• golang
• security
• security-tools
• security-automation

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

• aws
• gcp
• azure
• sql

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools

Quickly clone or backup massive amounts of org/users repositories into one directory - Supports GitHub, GitLab, Bitbucket, and more 🐇🥚

• github
• gitlab
• bitbucket
• clone

GitHub App to set and enforce security policies

Protect against malicious open source packages 🤖

• devsecops
• security
• supply-chain-security
• policy-as-code

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

• sast
• security-tools
• security-scanner
• security-automation

Lightweight Dockerfile linter that helps you write better Dockerfiles. Get instant feedback with quality scores, security checks, and 60+ best practice rules.

Pure-Go SQL parser, formatter, linter and security scanner for 8 dialects. Zero-copy, race-free, with an LSP and MCP server.

• ast
• cli
• go
• golang

CLI tool for running coding agents inside hardware-isolated microVMs

• ai-agents
• claude-code
• codex
• developer-tools

NullKia Mobile Security Framework - Tools in Nim, Crystal, V, D, Red, Odin, Haxe, Zig, Kotlin, Lua, PHP, Python | bad-antics | github.com/bad-antics

• android-hacking
• baseband
• bootloader-unlock
• checkm8

Local-first policy gateway for coding agents. Allow, review, or block MCP, shell, SQL, GitHub, and HTTP actions with scoped credentials and signed evidence.

• golang
• observability
• opentelemetry
• policy-engine

Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.

• aho-corasick
• cybersecurity
• devops
• git-hook

A developer CLI tool that manages .env files, detects secret leaks, syncs env drift across teammates, and validates environment parity between local/staging/prod all from your terminal. Written in Go.

• cli
• developer-tools
• devops
• dotenv

Open-source eBPF compatibility evidence and CI gate

• bpf
• ci
• compatibility
• ebpf

Static analysis from configs → Kubernetes NetworkPolicies in seconds

• cloud-native
• devsecops
• golang
• helm

Keep your secrets out of your AI coding agents. A local HTTPS proxy that swaps real credentials with placeholders and injects them at the network boundary.

• ai-agents
• claude-code
• cli
• developer-tools

Pin AI Skill behavior. Block unapproved drift in CI. See exactly what changed in every PR.

• ai
• ai-skills
• apache-2
• claude-code