CLI tool and library for generating a Software Bill of Materials from container images and filesystems
- containers
- docker
- go
- golang
Repository Index
47,133 repositories indexed
1–12 of 12 · Most stars
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Tfsec is now part of Trivy
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
🔥 Fast, strict, configurable, extensible, and beautiful linter for Go
- go
- golang
- linter
- static-analysis
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
- php
- github-actions
- php-extensions
- code-coverage
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
- clang
- cpp
- c
- clang-tidy
Linting tool for CloudFormation templates
- continuous-testing
- unit-testing
- cloudformation
- aws
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
- sast
- security-tools
- security-scanner
- security-automation
Detect non-inclusive language in your source code.
- inclusive
- inclusive-language
- linter
- golang
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code
PostgreSQL migration linter. Blocks unsafe migrations before merge: 112 rules, the real Postgres parser, lock analysis, auto-fix. CLI, GitHub Action, MCP.