Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.jiwoochris / artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity
• detection-engineering
• i18n
• +8 more

3.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

4.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

5.cskwork / scopeweaver

ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.

6.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

7.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

8.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

9.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

10.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

11.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

12.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

13.asciimoo / hister

Your own search engine

• history
• index
• search
• search-engine
• web
• mcp
• +5 more

14.twpayne / chezmoi

Manage your dotfiles across multiple diverse machines, securely.

• dotfiles
• configuration
• security
• macos
• linux
• windows
• +4 more

15.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

16.google / gvisor

Application Kernel for Containers

• sandbox
• containers
• oci
• docker
• kubernetes
• linux
• +1 more

17.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

18.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

19.kopia / kopia

Cross-platform backup tool for Windows, macOS & Linux with fast, incremental backups, client-side end-to-end encryption, compression and data deduplication. CLI and GUI included.

• deduplication
• backup
• google-cloud-storage
• encryption
• cloud

20.oauth2-proxy / oauth2-proxy

A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

• cloud-infrastructure
• oauth2-proxy
• ssl
• sso
• hacktoberfest
• oauth2
• +2 more

21.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

22.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

23.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

24.owasp-amass / amass

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration
• recon
• osint
• +7 more

25.anchore / grype

A vulnerability scanner for container images and filesystems

• containers
• security
• vulnerability
• docker
• golang
• go
• +9 more

26.goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

• cncf
• container
• registry
• helm
• cloud-native
• containers
• +6 more

27.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

28.fleetdm / fleet

Open device management

• osquery
• gitops
• device-management
• vulnerability-management
• binary-authorization
• configuration-management
• +12 more

29.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

30.openfga / openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

• authorization
• permissions
• security
• zanzibar
• openfga
• entitlements
• +11 more

31.gotify / server

A simple server for sending and receiving messages in real-time per WebSocket. (Includes a sleek web-ui)

• golang
• notifications
• api
• react
• javascript
• gotify
• +7 more

32.FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

• https
• tls
• certificates
• local-development
• localhost
• root-ca
• +6 more

33.safing / portmaster

🏔 Love Freedom - ❌ Block Mass Surveillance

• application-firewall
• dns
• firewall
• go
• golang
• privacy
• +5 more

34.kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

35.bytebase / bytebase

Database governance built for humans and agents — controlling changes and access across every major database.

• mysql
• tidb
• postgresql
• cicd
• sql-client
• oracle
• +14 more

36.bettercap / bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

• password-sniffer
• mitm
• rogue-ap
• wifi
• hacking
• security
• +14 more

37.projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

• http
• bugbounty
• ssl-certificate
• pipeline
• pentest-tool
• cybersecurity
• +4 more

38.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

39.hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management

• vault
• go
• secrets

40.corazawaf / coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

• coraza
• waf
• coraza-waf
• owasp-crs
• modsecurity
• coreruleset
• +6 more

41.Velocidex / velociraptor

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security
• endpoint-protection
• endpoint-discovery
• +1 more

42.gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.

• ssh
• go
• bastion
• teleport-binaries
• certificate
• golang
• +14 more

43.open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

• opa
• policy
• declarative
• json
• compliance
• cloud-native
• +2 more

44.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

45.gophish / gophish

Open-Source Phishing Toolkit

• gophish
• phishing
• golang
• security

46.slackhq / nebula

A scalable overlay networking tool with a focus on performance, simplicity and security

47.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

48.OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go

• go
• pentesting
• tool
• dns
• web

49.Forceu / Gokapi

Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported.

• selfhosted
• self-hosted
• download
• uploader
• firefox-send
• golang
• +5 more

50.stakater / Reloader

A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!

• kubernetes
• openshift
• configmap
• secrets
• pods
• deployments
• +5 more

51.dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

• oidc
• kubernetes
• idp
• identity-provider
• hacktoberfest

52.kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

• kubernetes
• security
• nsa
• mitre-attack
• devops
• best-practice
• +1 more

53.authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

• zanzibar
• permissions
• database
• distributed-systems
• security
• security-tools
• +12 more

54.ory / hydra

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

• hydra
• oauth2
• openid-connect
• docker
• server
• security
• +14 more

55.sbondCo / Watcharr

Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.

• go
• golang
• svelte
• sveltekit
• sqlite
• sqlite3
• +14 more

56.in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

• security-tools
• security
• attestation
• verification
• supply-chain

57.apache / casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

• casbin
• access-control
• authorization
• rbac
• abac
• acl
• +12 more

58.ory / kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

• identity
• identity-management
• user-management
• users
• user
• login
• +5 more

59.ginuerzh / gost

GO Simple Tunnel - a simple tunnel written in golang

• go
• tunnel
• golang
• shadowsocks
• quic
• kcp
• +9 more

60.openziti / ziti

The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti

• networking
• vpn-2
• appsec
• network
• zero-trust
• zero-trust-cloud
• +14 more

61.google / syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

• linux
• kernel
• fuzz-testing
• fuzzing
• fuzzer
• testing
• +3 more

62.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

63.gravitl / netmaker

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

• wireguard
• vpn
• mesh
• zero-trust
• devsecops
• k8s
• +14 more

64.flohoss / gocron

A task scheduler built with Go and Vue.js that allows users to specify recurring jobs via a simple YAML configuration file. The scheduler reads job definitions, executes commands at specified times using cron expressions, and passes in environment variables for each job.

• backup
• backups
• cron
• docker
• golang
• schedule
• +4 more

65.future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

• vuls
• vulnerability-scanners
• golang
• go
• linux
• freebsd
• +14 more

66.cert-manager / cert-manager

Automatically provision and manage TLS certificates in Kubernetes

• kubernetes
• letsencrypt
• tls
• certificate
• crd
• hacktoberfest

67.go-admin-team / go-admin

go-admin is a Gin + Vue starter kit for admin applications, supporting Element UI, Arco Design, and Ant Design. Features include multi-tenancy, user management, JWT authentication, RBAC, code generation, a form builder, and scheduled tasks. Build your own admin app in just 3 minutes.

• gin
• casbin
• gin-admin
• vue-admin
• gorm
• jwt
• +8 more

68.beelzebub-labs / beelzebub

A secure low code deception runtime framework, leveraging AI for System Virtualization.

• cybersecurity
• security
• honeypot
• framework
• go
• research-project
• +14 more

69.coipond / coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic
• coding-assistant
• containers
• +14 more

70.securego / gosec

Go security checker

• golang
• security
• security-tools
• security-automation
• static-analysis
• static-code-analysis

71.kubeshark / kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

• kubernetes
• golang
• rest
• grpc
• devops
• sniffer
• +14 more

72.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

73.nhost / nhost

The Open Source Firebase Alternative with GraphQL.

• postgres
• hasura
• graphql
• authentication
• storage
• serverless-functions
• +13 more

74.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

75.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

76.screego / server

screen sharing for developers https://screego.net/

• webrtc
• screensharing-tool
• privacy
• selfhosted
• docker
• go

77.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

78.aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security
• golang
• docker
• +2 more

79.jaksi / sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

• ssh
• honeypot
• go
• golang
• security

80.unkeyed / unkey

The Developer Platform for Modern APIs

• open-source
• authentication
• authorization
• gateway
• api
• api-keys
• +2 more

81.sensepost / gowitness

🔍 gowitness - a golang, web screenshot utility using Chrome Headless

• chrome
• headless
• screenshot
• security
• footprinting
• reporting
• +5 more

82.coinpaprika / coinpaprika-api-go-client

Official CoinPaprika API Go client — coin prices, tickers, OHLCV, exchanges, and global market stats.

• api-client
• bitcoin
• blockchain
• coinpaprika
• crypto
• cryptocurrency
• +4 more

83.turbot / steampipe

Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.

• steampipe
• postgresql
• postgresql-fdw
• cloud
• security
• aws
• +14 more

84.GreenmaskIO / greenmask

Database anonymization and test data management

• golang
• obfuscation
• postgresql
• security
• security-tools
• anonymization
• +14 more

85.Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools
• security
• security-tools
• +13 more

86.rudderlabs / rudder-server

Privacy and Security focused Segment-alternative, in Golang and React

• privacy
• warehouse-management
• data-warehouse
• customer-data
• customer-data-pipeline
• customer-data-platform
• +14 more

87.snail007 / goproxy

🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxies,nat forwarding in different lan,TCP/UDP port forwarding, SSH forwarding.Proxy是golang实现的高性能http,https,websocket,tcp,socks5代理服务器,支持内网穿透,链式代理,通讯加密,智能HTTP,SOCKS5代理,黑白名单,限速,限流量,限连接数,跨平台,KCP支持,认证API。

• http-proxy
• https-proxy
• reverse-proxy
• transparent-proxy
• socks5-proxy
• ss-proxy
• +14 more

88.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

89.OpenNHP / opennhp

Make your infrastructure invisible to attackers. OpenNHP implements the Network-infrastructure Hiding Protocol (NHP): authenticate before connection, cryptographically. IETF draft.

• cybersecurity
• zero-trust
• zero-trust-network-access
• zero-trust-security

90.wader / fq

fq - jq for binary formats. Tool, language and decoders for working with binary formats.

• jq
• binary
• hexdump
• go
• json
• decode
• +7 more

91.linkerd / linkerd2

Ultralight, security-first service mesh for Kubernetes. Main repo for Linkerd 2.x.

• service-mesh
• rust
• golang
• kubernetes
• linkerd
• cloud-native

92.usefathom / fathom

Fathom Lite. Simple, privacy-focused website analytics. Built with Golang & Preact.

• website-analytics
• analytics
• metrics
• privacy
• fathom
• google-analytics
• +2 more

93.cloudquery / cloudquery

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

• aws
• gcp
• azure
• sql
• data-integration
• elt
• +14 more

94.zitadel / oidc

Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation

• oidc
• oauth2
• openidconnect
• server
• client
• go
• +13 more

95.quay / clair

Vulnerability Static Analysis for Containers

• containers
• static-analysis
• go
• kubernetes
• docker
• oci
• +3 more

96.aquasecurity / tfsec

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis
• ci
• aws
• +13 more

97.halfrost / Halfrost-Field

✍🏻 Source Code Deep Dives, System Design & Engineering Blogs | Halfrost-Field 冰霜之地：源码解析、系统设计与工程实践笔记

• ios
• objective-c
• swift
• javascript
• golang
• go
• +14 more

98.lightningnetwork / lnd

Lightning Network Daemon ⚡️

• bitcoin
• lightning-network
• blockchain
• micropayments
• lightning
• protocol
• +4 more

99.activecm / rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control
• cyber-security
• network-traffic-analysis
• +10 more

100.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.