DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Repository Index
73,362 visible repositories in the index
49–72 of 1,223 · Most stars
Fast web fuzzer written in Go
- fuzzer
- pentesting
- infosec
- web
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
- cryptomator
- java
- cloud-storage
- cryptography
Automated Penetration Testing Agentic Framework Powered by Large Language Models
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
- full-stack
- open-source
- saas
- nodejs
The ZAP by Checkmarx Core project
- zap
- zap-development
- dast
- appsec
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
Connect your users to their apps
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
- information-gathering
- osint
- osint-tools
- open-source-intelligence
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
ZITADEL - Identity infrastructure, simplified for you.
- saml
- authentication
- authorization
- login
Open source alternative to Auth0 / Firebase Auth / AWS Cognito
- authentication
- session-management
- login
- supertokens
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
- security
- security-tools
- security-audit
- security-hardening
Web path scanner
🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
- authentication
- authorization
- identity
- openid-connect
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- owasp
- javascript
- vulnerable
- hacking
Directory/File, DNS and VHost busting tool written in Go
- go
- pentesting
- tool
- dns
Bitwarden client apps (web, browser extension, desktop, and cli).
- webextension
- javascript
- bitwarden
- typescript
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
- identity
- identity-management
- user-management
- users
CTF framework and exploit development library