Repository Index

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

• penetration-testing
• pentesting
• security-audit
• security-automation

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

• environment-variables
• secret-management
• secrets
• security

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.

• security
• security-tools
• security-audit
• security-hardening

Database governance built for humans and agents — controlling changes and access across every major database.

• mysql
• tidb
• postgresql
• cicd

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

• wireguard
• vpn
• mesh
• zero-trust

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

• nginx
• modsecurity
• docker
• security

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

• xonsh
• devops
• iterm2
• data-engineering

Blazing-fast remote access

• cloud
• vpn
• security
• wireguard

Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.

• steampipe
• postgresql
• postgresql-fdw
• cloud

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis

An authoritative list of awesome devsecops tools with the help from community experiments and contributions.

• devsecops
• threat-intelligence
• devops
• podcast

Open Source Cloud Native Application Protection Platform (CNAPP)

• cloud-native
• vulnerability-management
• threat-analysis
• devsecops

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

• scanning-tool
• secret-keys
• secrets-management
• infosectools

🔥Open source RASP solution

• waf
• devsecops
• security
• iast

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

• iac
• infrastructure-as-code
• security
• appsec

A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.

• appsec
• cicd
• devops
• infosec

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

• threat-modeling
• practical-devsecops
• security-review
• devsecops-university

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

• api-security
• application-security
• kubernetes
• nginx

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

• tokenization
• web-security
• compliance
• security