71,372 visible repositories in the index
1–24 of 46 · Most stars
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
A static analyzer for Java, C, C++, and Objective-C
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Static code analysis for Kotlin
Tfsec is now part of Trivy
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
It's not just a linter that annoys you!
An extensible multilanguage static code analyzer.
🚀Optimizer for mobile applications
An MCP server plus a CLI tool that indexes local code into a graph database to provide context to AI assistants.
A Mac App to find unused images and resources in Xcode project.
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
Real-time architectural sensor that helps AI agents close the feedback loop, enabling recursive self-improvement of code quality. Pure Rust.
Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Interactive architecture diagrams for codebases
weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.
Pre-submission compliance scanner for the Apple App Store and Google Play. Scans code, privacy manifests, Android manifests, and IPA/APK/AAB binaries against the review guidelines. Offline, no account.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)