Trending repositories

1.BaaRai / ARTEX

ARTEX - AI autonomous penetration testing system (English translation)

2.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

3.jiwoochris / artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity
• detection-engineering
• i18n
• +8 more

4.RuoJi6 / ARTEX

Autumn-27/ARTEX 持续维护开源版本

• agent
• artex

5.DrWhax / unfairplay

Decrypt IPA's on MacOS

6.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

7.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

8.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

9.Hinln / ARTEX

ARTEX 源码备份：基于 Autumn-27/ARTEX v0.3.15，保留原始提交历史与 AGPL-3.0 许可证。

10.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

11.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

12.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

13.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

14.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

15.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

16.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

17.asciimoo / hister

Your own search engine

• history
• index
• search
• search-engine
• web
• mcp
• +5 more

18.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

19.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

20.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

21.fleetdm / fleet

Open device management

• osquery
• gitops
• device-management
• vulnerability-management
• binary-authorization
• configuration-management
• +12 more

22.cskwork / scopeweaver

ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.

23.Forceu / Gokapi

Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported.

• selfhosted
• self-hosted
• download
• uploader
• firefox-send
• golang
• +5 more

24.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

25.anchore / grype

A vulnerability scanner for container images and filesystems

• containers
• security
• vulnerability
• docker
• golang
• go
• +9 more

26.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

27.goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

• cncf
• container
• registry
• helm
• cloud-native
• containers
• +6 more

28.owasp-amass / amass

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration
• recon
• osint
• +7 more

29.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

30.openfga / openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

• authorization
• permissions
• security
• zanzibar
• openfga
• entitlements
• +11 more

31.FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

• https
• tls
• certificates
• local-development
• localhost
• root-ca
• +6 more

32.bettercap / bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

• password-sniffer
• mitm
• rogue-ap
• wifi
• hacking
• security
• +14 more

33.gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.

• ssh
• go
• bastion
• teleport-binaries
• certificate
• golang
• +14 more

34.kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

35.projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

• http
• bugbounty
• ssl-certificate
• pipeline
• pentest-tool
• cybersecurity
• +4 more

36.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

37.gophish / gophish

Open-Source Phishing Toolkit

• gophish
• phishing
• golang
• security

38.Velocidex / velociraptor

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security
• endpoint-protection
• endpoint-discovery
• +1 more

39.sbondCo / Watcharr

Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.

• go
• golang
• svelte
• sveltekit
• sqlite
• sqlite3
• +14 more

40.corazawaf / coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

• coraza
• waf
• coraza-waf
• owasp-crs
• modsecurity
• coreruleset
• +6 more

41.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

42.stakater / Reloader

A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!

• kubernetes
• openshift
• configmap
• secrets
• pods
• deployments
• +5 more

43.openziti / ziti

The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti

• networking
• vpn-2
• appsec
• network
• zero-trust
• zero-trust-cloud
• +14 more

44.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

45.open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

• opa
• policy
• declarative
• json
• compliance
• cloud-native
• +2 more

46.hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management

• vault
• go
• secrets

47.authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

• zanzibar
• permissions
• database
• distributed-systems
• security
• security-tools
• +12 more

48.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

49.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

50.coipond / coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic
• coding-assistant
• containers
• +14 more

51.ory / hydra

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

• hydra
• oauth2
• openid-connect
• docker
• server
• security
• +14 more

52.cert-manager / cert-manager

Automatically provision and manage TLS certificates in Kubernetes

• kubernetes
• letsencrypt
• tls
• certificate
• crd
• hacktoberfest

53.future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

• vuls
• vulnerability-scanners
• golang
• go
• linux
• freebsd
• +14 more

54.OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go

• go
• pentesting
• tool
• dns
• web

55.dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

• oidc
• kubernetes
• idp
• identity-provider
• hacktoberfest

56.openbin-ai / binny

BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.

• ghidra
• llm-agent
• malware-analysis
• ollama
• reverse-engineering
• security-research

57.kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

• kubernetes
• security
• nsa
• mitre-attack
• devops
• best-practice
• +1 more

58.beelzebub-labs / beelzebub

A secure low code deception runtime framework, leveraging AI for System Virtualization.

• cybersecurity
• security
• honeypot
• framework
• go
• research-project
• +14 more

59.ory / kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

• identity
• identity-management
• user-management
• users
• user
• login
• +5 more

60.securego / gosec

Go security checker

• golang
• security
• security-tools
• security-automation
• static-analysis
• static-code-analysis

61.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

62.aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security
• golang
• docker
• +2 more

63.rudderlabs / rudder-server

Privacy and Security focused Segment-alternative, in Golang and React

• privacy
• warehouse-management
• data-warehouse
• customer-data
• customer-data-pipeline
• customer-data-platform
• +14 more

64.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

65.Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools
• security
• security-tools
• +13 more

66.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

67.google / syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

• linux
• kernel
• fuzz-testing
• fuzzing
• fuzzer
• testing
• +3 more

68.nhost / nhost

The Open Source Firebase Alternative with GraphQL.

• postgres
• hasura
• graphql
• authentication
• storage
• serverless-functions
• +13 more

69.rabbitstack / fibratus

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security
• etw
• blue-team
• +13 more

70.zitadel / oidc

Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation

• oidc
• oauth2
• openidconnect
• server
• client
• go
• +13 more

71.Zibbp / ganymede

Twitch VOD and Live Stream archiving platform. Includes a rendered and real-time chat for each archive.

• archive
• archived
• chat
• streaming
• twitch
• vod
• +4 more

72.screego / server

screen sharing for developers https://screego.net/

• webrtc
• screensharing-tool
• privacy
• selfhosted
• docker
• go

73.wader / fq

fq - jq for binary formats. Tool, language and decoders for working with binary formats.

• jq
• binary
• hexdump
• go
• json
• decode
• +7 more

74.yunginnanet / HellPot

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

• honeypot
• http
• web
• deception
• stress
• cross-platform
• +6 more

75.safedep / vet

Protect against malicious open source packages 🤖

• devsecops
• security
• supply-chain-security
• policy-as-code
• software-composition-analysis
• golang
• +5 more

76.NodePassProject / nodepass

A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections.

• api-rest
• connection-pooling
• cybersecurity
• devops
• golang
• http2
• +14 more

77.assetnote / h3fuzz

Content discovery and fuzzing with HTTP/3 support (100k requests per second)

78.cloudquery / cloudquery

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

• aws
• gcp
• azure
• sql
• data-integration
• elt
• +14 more

79.evilsocket / xrayArchived

XRay is a tool for recon, mapping and OSINT gathering from public networks.

• osint
• security
• network
• shodan
• intelligence
• mapping

80.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

81.go-jose / go-jose

An implementation of JOSE standards (JWE, JWS, JWT) in Go

82.apache / casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

• casbin
• access-control
• authorization
• rbac
• abac
• acl
• +12 more

83.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

84.aquasecurity / tfsec

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis
• ci
• aws
• +13 more

85.unkeyed / unkey

The Developer Platform for Modern APIs

• open-source
• authentication
• authorization
• gateway
• api
• api-keys
• +2 more

86.sensepost / gowitness

🔍 gowitness - a golang, web screenshot utility using Chrome Headless

• chrome
• headless
• screenshot
• security
• footprinting
• reporting
• +5 more

87.lukechilds / reverse-shell

Reverse Shell as a Service

• reverse-shell
• exploit
• vulnerability
• pentesting
• microservice
• security

88.GreenmaskIO / greenmask

Database anonymization and test data management

• golang
• obfuscation
• postgresql
• security
• security-tools
• anonymization
• +14 more

89.c9s / bbgo

The modern cryptocurrency trading bot framework written in Go.

• trading
• trading-bot
• cryptocurrency
• binance
• bitcoin
• crypto

90.SSLMate / certspotter

Lightweight Certificate Transparency Log Monitor

• certificate-transparency
• pki
• x509
• security
• webpki

91.Luzifer / ots

One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser

• one-time-secret
• golang
• encryption
• aes256

92.lightningnetwork / lnd

Lightning Network Daemon ⚡️

• bitcoin
• lightning-network
• blockchain
• micropayments
• lightning
• protocol
• +4 more

93.usefathom / fathom

Fathom Lite. Simple, privacy-focused website analytics. Built with Golang & Preact.

• website-analytics
• analytics
• metrics
• privacy
• fathom
• google-analytics
• +2 more

94.Permify / permify

An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

• access-control
• authorization
• rbac
• rebac
• zanzibar
• acl
• +13 more

95.ory / keto

The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.

• hacktoberfest
• abac
• access-control
• acl
• authorization
• fine-grained-permissions
• +8 more

96.prest / prest

Instant REST and MCP APIs for PostgreSQL and MySQL, on existing or new databases. CRUD, custom SQL routes, auth and ACL without writing a backend. Low-code, ⚡ realtime, high-performance. Native MySQL support since v2.5

• postgresql
• golang
• postgres
• rest-api
• database
• low-code
• +14 more

97.microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

• sanitization
• html
• security
• xss
• go
• owasp
• +2 more

98.lestrrat-go / jwx

Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe

• jwt
• jwe
• jws
• jwk
• go
• golang
• +1 more

99.gabrie30 / ghorg

Quickly clone or backup massive amounts of org/users repositories into one directory - Supports GitHub, GitLab, Bitbucket, and more 🐇🥚

• github
• gitlab
• bitbucket
• clone
• gitea
• go
• +2 more

100.jaksi / sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

• ssh
• honeypot
• go
• golang
• security