preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack.
Repository Index
47,133 repositories indexed
25–42 of 42 · Most stars
A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
- in-toto
- software-supply-chain
- security
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
- cve-2026-109618
- cve-2026-109619
- exploit
- memory-corruption
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Find which of your direct GitHub dependencies is susceptible to RepoJacking attacks
- golang
- go
- supply-chain
- security
Markov-chains for linguistically-correct password cracking
Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
Security training for the apps you actually ship. Open your browser and start hacking.
Phraser is a phrase generator using n-grams and Markov chains to generate phrases for passphrase cracking. The generated phraselists can be used as wordlists in your favourite password cracking application.
AWS Encryption SDK for Go
- aws
- aws-encryption-sdk
- aws-kms
- aws-sdk-go
Prompt-injection firewall for LLM applications — 33 input detectors, 9 output scanners, federated ed25519-signed threat-intel feed. Apache 2.0, 1040 tests, F1 96.0% with 0% false positives. Docker, GitHub Action, LangChain/LlamaIndex/CrewAI integrations.
- agentic-ai
- ai-safety
- fastapi
- langchain
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code
Encrypted .env files with TOTP unsealing for production deploys. Cross-stack (Node + Java). Zero deps. Defends against npm supply-chain attacks.
- 2fa
- aes-gcm
- dotenv
- encryption
A ruby implementation of bip-schnorr
- bitcoin
- schnorr
- musig2
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.
- cdn
- cve
- polyfill
- polyfill-io
💬 Lightweight AlgoChat client for corvid-agent — GitHub Pages hosted
- algochat
- algorand
- blockchain
- encrypted-messaging
security audits by Tenset Security
- audits
- blockchain
- security
- security-review