Repository Index

Ghidra is a software reverse engineering (SRE) framework

• software-analysis
• disassembler
• reverse-engineering

Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.

• cryptomator
• java
• cloud-storage
• cryptography

The ZAP by Checkmarx Core project

• zap
• zap-development
• dast
• appsec

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

• sso-authentication
• authentication
• authorization
• java

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

Library for OpenAPI 3 with spring-boot

• openapi3
• spring-boot
• springdoc-openapi
• swagger-ui

Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.

• ssh
• bastion-host
• java
• javascript

Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

• android-application
• security-analysis
• dynamic-analysis
• xposed

A p2p, secure file storage, social network and application protocol

• java
• peer-to-peer
• encryption
• social-network

Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

• java
• security
• authentication
• authorization

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

• findbugs
• java
• security-audit
• owasp

🦎 A lightweight, streaming-native, multi-protocol gateway for AI, APIs, and real-time data. Route LLM requests across providers, govern MCP tools, and connect Kafka, MQTT, and HTTP through one high-performance engine with shared security and observability.

• kafka
• rest
• server-sent-events
• streaming-api

Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

• java
• sonarqube
• static-code-analysis
• static-analyzer

Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

• application-security
• appsec
• bug-bounty
• burp-alternative

Oversecured Vulnerable Android App

• appsec
• android-security
• vulnerable-application
• vulnerable-android-apps

🔐 Tutorial of setting up Security for your API with one way authentication with TLS/SSL and mutual authentication for a java based web server and a client with both Spring Boot. Different clients are provided such as Apache HttpClient, OkHttp, Spring RestTemplate, Spring WebFlux WebClient Jetty and Netty, the old and the new JDK HttpClient, the old and the new Jersey Client, Google HttpClient, Unirest, Retrofit, Feign, Methanol, vertx, Scala client Finagle, Featherbed, Dispatch Reboot, AsyncHttpClient, Sttp, Akka, Requests Scala, Http4s Blaze, Kotlin client Fuel, http4k, Kohttp and ktor. Also other server examples are available such as jersey with grizzly. Also gRPC, WebSocket and ElasticSearch examples are included

• tls
• truststore
• certificate
• keystore

🔐 An SSL library for configuring http client or server. Rich with features such as hot reloading ssl and trusting additional certificates during runtime, combining multiple keystores, loading pem files and os/jdk certificates, logging certificate information during ssl handshake, bypassing ssl configuration from other libraries and more

• tls
• ssl
• certificate
• keystore

Security profiling for blackbox Android

Gravitee.io - OpenSource API Management

• api
• api-management
• gateway
• java

Java cryptographic library that supports Argon2, bcrypt, scrypt and PBKDF2 aimed to protect passwords in databases. Easy to use by design, highly customizable, secure and portable. All the implementations follow the standards and have been reviewed to perform better in the JVM.

• pbkdf2
• bcrypt
• scrypt
• argon2

Java implementation of Tink

• crypto
• cryptography
• java
• security

A small and easy-to-use one-time password generator library for Java implementing RFC 4226 (HOTP) and RFC 6238 (TOTP).

• java
• otp
• totp
• hotp