A vulnerability scanner for container images and filesystems
Repository Index
47,133 repositories indexed
1–17 of 17 · Most stars
Dockerfile linter, validate inline bash, written in Haskell
- dockerfile
- linter
- shellcheck
- haskell
Vulnerability Static Analysis for Containers
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
- containers
- docker
- go
- golang
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Tfsec is now part of Trivy
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
🔥 Fast, strict, configurable, extensible, and beautiful linter for Go
- go
- golang
- linter
- static-analysis
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
- php
- github-actions
- php-extensions
- code-coverage
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
- clang
- cpp
- c
- clang-tidy
Linting tool for CloudFormation templates
- continuous-testing
- unit-testing
- cloudformation
- aws
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
- agent-skills
- ai-agents
- ai-code-review
- claude-code
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
- sast
- security-tools
- security-scanner
- security-automation
Detect non-inclusive language in your source code.
- inclusive
- inclusive-language
- linter
- golang
Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.
- ai-code-review
- cli
- code-review
- developer-tools
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code
PostgreSQL migration linter. Blocks unsafe migrations before merge: 112 rules, the real Postgres parser, lock analysis, auto-fix. CLI, GitHub Action, MCP.