47,133 repositories indexed
1–24 of 33 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Go security checker
Bandit is a tool designed to find common security issues in Python code.
A static analysis security vulnerability scanner for Ruby on Rails applications
Tfsec is now part of Trivy
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
Security-focused static analysis for the Phoenix Framework
grep rough audit - source code auditing tool
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Linting tool for CloudFormation templates
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
NGINX configuration static analyzer
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.