47,133 repositories indexed
1–19 of 19 · Most stars
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Catch common Java mistakes as compile-time errors
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
🔰 Instant PHP quality checks from your console
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
Detect uses of legacy Java APIs
A high-performance static analysis toolkit for Ruby
A static analysis tool for security
Useful tools for Sorbet enthusiasts
apicompat checks recent changes to a Go project for backwards incompatible changes
Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.
Security linter for AI-generated code: catches the exact vulnerabilities Copilot, Cursor and ChatGPT repeatedly produce. SQL injection, hardcoded secrets, JWT bypass, command injection and 15+ more rules. Grade A–F. Zero config. CI/CD ready.