DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
Hide secrets with invisible characters in plain text securely using passwords 🧙🏻♂️⭐
Cloud Security Posture Management (CSPM)
Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.
A microservices API Gateway built on top of Express.js
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
📗 How to write cross-platform Node.js code
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
[WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re).
Add a layer of active defense to your cloud applications.
A honeypot proxy for mongodb. When run, this will proxy and log all traffic to a dummy mongodb server.
Secure diceware passphrase generator
A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.
Cloverleaf is a free, open source app to replace your password manager without storing your passwords anywhere.
Capture, inspect, and replay webhooks with 90-day history + signature verification. Built on Cloudflare Workers + D1.
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
🔌 OSINT & Security Extensions for Marshall Browser - Installable plugins for enhanced reconnaissance and security testing
A secure, client-side tool to broadcast a signed Bitcoin (BTC) transaction from an air-gapped wallet. Fetch UTXOs, regenerate QR codes, and submit raw hex transactions safely.