Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Repository Index
47,133 repositories indexed
1–24 of 25 · Most stars
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
🤖 The Modern Port Scanner 🤖
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
A vulnerability scanner for container images and filesystems
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
- vuls
- vulnerability-scanners
- golang
- go
A powerful open-source tool for managing networks and troubleshooting network problems!
- ip-scanner
- port-scanner
- wifi
- ping-monitor
🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩💻
- shodan
- infosec
- pentesting
- iot
Tfsec is now part of Trivy
Open Source Cloud Native Application Protection Platform (CNAPP)
- cloud-native
- vulnerability-management
- threat-analysis
- devsecops
:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:
- scanning-tool
- secret-keys
- secrets-management
- infosectools
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Th3Inspector 🕵️ Best Tool For Information Gathering 🔎
- information-gathering
- reverse-phone-lookup
- mx-lookup
- whois-lookup
Node.js framework made by a former @expressjs TC and @koajs team member. Built for @forwardemail, @spamscanner, @breejs, @cabinjs, and @lassjs.
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
- tokenization
- web-security
- compliance
- security
Finala is an open-source resource cloud scanner that analyzes, discloses, presents and notifies about wasteful and unused resources.
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
- pentesting
- security
- chrome-extension
- api-keys
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
- clamscan
- file-scanner
- virus-scan
- docker-compose
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
- sast
- security-tools
- security-scanner
- security-automation
Gixy-Next: NGINX Configuration Security Scanner & Performance Checker
Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.
- aho-corasick
- cybersecurity
- devops
- git-hook
Lightweight Docker monitoring dashboard with anomaly detection & Telegram alerts. One-liner install, zero config.
Prompt-injection firewall for LLM applications — 33 input detectors, 9 output scanners, federated ed25519-signed threat-intel feed. Apache 2.0, 1040 tests, F1 96.0% with 0% false positives. Docker, GitHub Action, LangChain/LlamaIndex/CrewAI integrations.
- agentic-ai
- ai-safety
- fastapi
- langchain
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code