Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.jiwoochris / artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity
• detection-engineering
• i18n
• +8 more

3.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

4.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

5.cskwork / scopeweaver

ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.

6.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

7.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

8.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

9.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

10.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

11.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

12.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

13.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

14.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

15.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

16.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

17.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

18.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

19.owasp-amass / amass

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration
• recon
• osint
• +7 more

20.anchore / grype

A vulnerability scanner for container images and filesystems

• containers
• security
• vulnerability
• docker
• golang
• go
• +9 more

21.goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

• cncf
• container
• registry
• helm
• cloud-native
• containers
• +6 more

22.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

23.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

24.openfga / openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

• authorization
• permissions
• security
• zanzibar
• openfga
• entitlements
• +11 more

25.FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

• https
• tls
• certificates
• local-development
• localhost
• root-ca
• +6 more

26.kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

27.bettercap / bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

• password-sniffer
• mitm
• rogue-ap
• wifi
• hacking
• security
• +14 more

28.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

29.hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management

• vault
• go
• secrets

30.Velocidex / velociraptor

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security
• endpoint-protection
• endpoint-discovery
• +1 more

31.gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.

• ssh
• go
• bastion
• teleport-binaries
• certificate
• golang
• +14 more

32.open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

• opa
• policy
• declarative
• json
• compliance
• cloud-native
• +2 more

33.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

34.gophish / gophish

Open-Source Phishing Toolkit

• gophish
• phishing
• golang
• security

35.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

36.OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go

• go
• pentesting
• tool
• dns
• web

37.stakater / Reloader

A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!

• kubernetes
• openshift
• configmap
• secrets
• pods
• deployments
• +5 more

38.dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

• oidc
• kubernetes
• idp
• identity-provider
• hacktoberfest

39.kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

• kubernetes
• security
• nsa
• mitre-attack
• devops
• best-practice
• +1 more

40.authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

• zanzibar
• permissions
• database
• distributed-systems
• security
• security-tools
• +12 more

41.ory / hydra

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

• hydra
• oauth2
• openid-connect
• docker
• server
• security
• +14 more

42.sbondCo / Watcharr

Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.

• go
• golang
• svelte
• sveltekit
• sqlite
• sqlite3
• +14 more

43.in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

• security-tools
• security
• attestation
• verification
• supply-chain

44.apache / casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

• casbin
• access-control
• authorization
• rbac
• abac
• acl
• +12 more

45.jhaals / yopass

Secure sharing of secrets, passwords and files

• password-share
• encryption-decryption
• file-upload
• onetimelink
• onetimesecret
• secret-sharing

46.ory / kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

• identity
• identity-management
• user-management
• users
• user
• login
• +5 more

47.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

48.flohoss / gocron

A task scheduler built with Go and Vue.js that allows users to specify recurring jobs via a simple YAML configuration file. The scheduler reads job definitions, executes commands at specified times using cron expressions, and passes in environment variables for each job.

• backup
• backups
• cron
• docker
• golang
• schedule
• +4 more

49.future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

• vuls
• vulnerability-scanners
• golang
• go
• linux
• freebsd
• +14 more

50.cert-manager / cert-manager

Automatically provision and manage TLS certificates in Kubernetes

• kubernetes
• letsencrypt
• tls
• certificate
• crd
• hacktoberfest

51.beelzebub-labs / beelzebub

A secure low code deception runtime framework, leveraging AI for System Virtualization.

• cybersecurity
• security
• honeypot
• framework
• go
• research-project
• +14 more

52.coipond / coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic
• coding-assistant
• containers
• +14 more

53.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

54.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

55.spiffe / spire

The SPIFFE Runtime Environment

56.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

57.bitnami / sealed-secrets

A Kubernetes controller and tool for one-way encrypted Secrets

• kubernetes
• kubernetes-secrets
• devops-workflow
• encrypt-secrets
• gitops

58.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

59.aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security
• golang
• docker
• +2 more

60.jaksi / sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

• ssh
• honeypot
• go
• golang
• security

61.coinpaprika / coinpaprika-api-go-client

Official CoinPaprika API Go client — coin prices, tickers, OHLCV, exchanges, and global market stats.

• api-client
• bitcoin
• blockchain
• coinpaprika
• crypto
• cryptocurrency
• +4 more

62.turbot / steampipe

Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.

• steampipe
• postgresql
• postgresql-fdw
• cloud
• security
• aws
• +14 more

63.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

64.zitadel / oidc

Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation

• oidc
• oauth2
• openidconnect
• server
• client
• go
• +13 more

65.quay / clair

Vulnerability Static Analysis for Containers

• containers
• static-analysis
• go
• kubernetes
• docker
• oci
• +3 more

66.coreos / go-oidc

A Go OpenID Connect client.

• golang

67.activecm / rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control
• cyber-security
• network-traffic-analysis
• +10 more

68.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.

69.caddyserver / certmagic

Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal

• https
• acme
• letsencrypt
• golang
• go
• automatic-https
• +2 more

70.SSLMate / certspotter

Lightweight Certificate Transparency Log Monitor

• certificate-transparency
• pki
• x509
• security
• webpki

71.yunginnanet / HellPot

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

• honeypot
• http
• web
• deception
• stress
• cross-platform
• +6 more

72.alexedwards / scs

HTTP Session Management for Go

• go
• golang
• session
• sessions
• http
• context

73.lestrrat-go / jwx

Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe

• jwt
• jwe
• jws
• jwk
• go
• golang
• +1 more

74.safedep / vet

Protect against malicious open source packages 🤖

• devsecops
• security
• supply-chain-security
• policy-as-code
• software-composition-analysis
• golang
• +5 more

75.rabbitstack / fibratus

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security
• etw
• blue-team
• +13 more

76.sigstore / rekor

Software Supply Chain Transparency Log

• supply-chain
• provenance
• security
• transparency-log

77.Permify / permify

An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

• access-control
• authorization
• rbac
• rebac
• zanzibar
• acl
• +13 more

78.google / uuid

Go package for UUIDs based on RFC 4122 and DCE 1.1: Authentication and Security Services.

• go
• uuid

79.ory / keto

The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.

• hacktoberfest
• abac
• access-control
• acl
• authorization
• fine-grained-permissions
• +8 more

80.lukechilds / reverse-shell

Reverse Shell as a Service

• reverse-shell
• exploit
• vulnerability
• pentesting
• microservice
• security

81.Luzifer / ots

One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser

• one-time-secret
• golang
• encryption
• aes256

82.deckrun / dockadvisor

Lightweight Dockerfile linter that helps you write better Dockerfiles. Get instant feedback with quality scores, security checks, and 60+ best practice rules.

83.txthinking / brook

A cross-platform programmable network tool

• proxy
• vpn
• linux
• macos
• ios
• android
• +14 more

84.Zibbp / ganymede

Twitch VOD and Live Stream archiving platform. Includes a rendered and real-time chat for each archive.

• archive
• archived
• chat
• streaming
• twitch
• vod
• +4 more

85.NodePassProject / nodepass

A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections.

• api-rest
• connection-pooling
• cybersecurity
• devops
• golang
• http2
• +14 more

86.jesseduffield / horcrux

Split your file into encrypted fragments so that you don't need to remember a passcode

87.ossf / allstar

GitHub App to set and enforce security policies

88.pipe-cd / pipecd

The One CD for All {applications, platforms, operations}

• kubernetes
• terraform
• serverless
• gitops
• infrastructure
• istio
• +13 more

89.go-jose / go-jose

An implementation of JOSE standards (JWE, JWS, JWT) in Go

90.99designs / aws-vault

A vault for securely storing and accessing AWS credentials in development environments

• aws
• iam
• temporary-credentials
• keychain
• credentials
• cli
• +2 more

91.golang / oauth2

Go OAuth2

• go
• golang
• oauth2
• oauth2-client

92.microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

• sanitization
• html
• security
• xss
• go
• owasp
• +2 more

93.awnumar / memguard

Software sandbox for storage of sensitive information in memory.

• security
• golang
• go
• cryptography
• memory
• crypto

94.bad-antics / nullkia

NullKia Mobile Security Framework - Tools in Nim, Crystal, V, D, Red, Odin, Haxe, Zig, Kotlin, Lua, PHP, Python | bad-antics | github.com/bad-antics

• android-hacking
• baseband
• bootloader-unlock
• checkm8
• firmware-hacking
• ios-jailbreak
• +14 more

95.evilsocket / xrayArchived

XRay is a tool for recon, mapping and OSINT gathering from public networks.

• osint
• security
• network
• shodan
• intelligence
• mapping

96.traggo / server

self-hosted tag-based time tracking

• golang
• selfhosted
• freesoftware
• privacy
• self-hosted
• timetracking
• +2 more

97.securitybunker / databunker

Secure Vault for Customer PII/PHI/PCI/KYC Records

• gdpr
• pii
• piidata
• security
• privacy
• privacy-by-design
• +14 more

98.oxyno-zeta / s3-proxy

S3 Reverse Proxy with GET, PUT and DELETE methods and authentication (OpenID Connect and Basic Auth)

• s3
• openid-connect
• basic-authentication
• s3-proxy
• s3-bucket
• serve-static
• +2 more

99.elC0mpa / aws-doctor

Powerful open-source CLI to audit security, costs, and best practices in AWS. 🩺 ☁️

• aws
• aws-billing
• aws-cli
• aws-cost-explorer
• cli
• go
• +3 more

100.aarondl / authboss

The boss of http auth.