Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Repository Index
47,133 repositories indexed
1–24 of 56 · Most stars
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
Source code for Hacker101.com - a free online web and mobile security class.
Low code web framework for real world applications, in Python and Javascript
Go security checker
Bandit is a tool designed to find common security issues in Python code.
Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.
Tfsec is now part of Trivy
🚗 A curated list of resources for learning about vehicle security and car hacking.
Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
A secure low code deception runtime framework, leveraging AI for System Virtualization.
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
grep rough audit - source code auditing tool
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
📗 How to write cross-platform Node.js code
npm package for OpenID Connect, OAuth Code Flow with PKCE, Refresh tokens, Implicit Flow
PHP library for Two Factor Authentication (TFA / 2FA)
Protect against malicious open source packages 🤖