Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Repository Index
80,339 visible repositories in the index
1–24 of 25 · Most stars
Static code analysis for Kotlin
- static
- analysis
- kotlin
- codesmells
Tfsec is now part of Trivy
- terraform
- security
- scanner
- static-analysis
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
- static-analysis
- php
- type-inference
- security-analysis
It's not just a linter that annoys you!
An extensible multilanguage static code analyzer.
- code-analysis
- code-quality
- static-analysis
- static-code-analysis
An MCP server plus a CLI tool that indexes local code into a graph database to provide context to AI assistants.
- hacktoberfest2025
- social-winter-of-code
- codegraph
- codegraphcontext
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
- findbugs
- static-analysis
- code-analysis
- static-code-analysis
KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
- static-analysis
- yaml-files
- helm-charts
- kubernetes
Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.
- kubernetes
- linter
- ci
- go
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Interactive architecture diagrams for codebases
Pre-submission compliance scanner for the Apple App Store and Google Play. Scans code, privacy manifests, Android manifests, and IPA/APK/AAB binaries against the review guidelines. Offline, no account.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
- mess-detector
- php
- pmd
- static-analysis
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
- findbugs
- java
- security-audit
- owasp
Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.
:bar_chart: Code City metaphor for visualizing Go source code in 3D
- golang
- go
- react
- visualization
A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects
- csharp-sourcegenerator
- hacktoberfest
- patterns
- contributions-welcome
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
- attack-surfaces
- pentesting
- security
- devsecops
Linting tool for CloudFormation templates
- continuous-testing
- unit-testing
- cloudformation
- aws
An analyzer library for C# and VB that uses Roslyn to produce refactorings, code analysis, and other niceties.
- hacktoberfest
Protect against malicious open source packages 🤖
A fist full of code metrics
- code-quality
- hacktoberfest
- maintainability
- software-quality
A static code analyser for annotated TODO comments
- go
- linters
- todo
- hacktoberfest