47,133 repositories indexed
1–24 of 29 · Most stars
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Find secrets with Gitleaks 🔑
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
Find, verify, and analyze leaked credentials
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.
Open Source Cloud Native Application Protection Platform (CNAPP)
:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:
🔥Open source RASP solution
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
Protect against malicious open source packages 🤖
The AI Agent for Cyber Security.
Catch risky npm dependency changes before they merge.
Cyber Incident Response Team Playbook Battle Cards
Open Source SIEM (Security Information and Event Management system).
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
Zero-code K8s sidecar for log sanitization. Detects secrets via Entropy Analysis, preserves JSON integrity, and redacts PII deterministically. 🛡️
preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack.
Safe access to production databases
Real-time secret-leak guardrails for AI coding agents (Claude Code, Codex), Git hooks, and CI.