Trending repositories

1.BaaRai / ARTEX

ARTEX - AI autonomous penetration testing system (English translation)

2.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

3.jiwoochris / artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity
• detection-engineering
• i18n
• +8 more

4.RuoJi6 / ARTEX

Autumn-27/ARTEX 持续维护开源版本

• agent
• artex

5.DrWhax / unfairplay

Decrypt IPA's on MacOS

6.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

7.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

8.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

9.Hinln / ARTEX

ARTEX 源码备份：基于 Autumn-27/ARTEX v0.3.15，保留原始提交历史与 AGPL-3.0 许可证。

10.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

11.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

12.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

13.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

14.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

15.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

16.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

17.asciimoo / hister

Your own search engine

• history
• index
• search
• search-engine
• web
• mcp
• +5 more

18.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

19.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

20.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

21.fleetdm / fleet

Open device management

• osquery
• gitops
• device-management
• vulnerability-management
• binary-authorization
• configuration-management
• +12 more

22.cskwork / scopeweaver

ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.

23.kopia / kopia

Cross-platform backup tool for Windows, macOS & Linux with fast, incremental backups, client-side end-to-end encryption, compression and data deduplication. CLI and GUI included.

• deduplication
• backup
• google-cloud-storage
• encryption
• cloud

24.Forceu / Gokapi

Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported.

• selfhosted
• self-hosted
• download
• uploader
• firefox-send
• golang
• +5 more

25.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

26.anchore / grype

A vulnerability scanner for container images and filesystems

• containers
• security
• vulnerability
• docker
• golang
• go
• +9 more

27.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

28.goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

• cncf
• container
• registry
• helm
• cloud-native
• containers
• +6 more

29.owasp-amass / amass

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration
• recon
• osint
• +7 more

30.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

31.gotify / server

A simple server for sending and receiving messages in real-time per WebSocket. (Includes a sleek web-ui)

• golang
• notifications
• api
• react
• javascript
• gotify
• +7 more

32.openfga / openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

• authorization
• permissions
• security
• zanzibar
• openfga
• entitlements
• +11 more

33.oauth2-proxy / oauth2-proxy

A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

• cloud-infrastructure
• oauth2-proxy
• ssl
• sso
• hacktoberfest
• oauth2
• +2 more

34.FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

• https
• tls
• certificates
• local-development
• localhost
• root-ca
• +6 more

35.bettercap / bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

• password-sniffer
• mitm
• rogue-ap
• wifi
• hacking
• security
• +14 more

36.gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.

• ssh
• go
• bastion
• teleport-binaries
• certificate
• golang
• +14 more

37.kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

38.projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

• http
• bugbounty
• ssl-certificate
• pipeline
• pentest-tool
• cybersecurity
• +4 more

39.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

40.safing / portmaster

🏔 Love Freedom - ❌ Block Mass Surveillance

• application-firewall
• dns
• firewall
• go
• golang
• privacy
• +5 more

41.gophish / gophish

Open-Source Phishing Toolkit

• gophish
• phishing
• golang
• security

42.bytebase / bytebase

Database governance built for humans and agents — controlling changes and access across every major database.

• mysql
• tidb
• postgresql
• cicd
• sql-client
• oracle
• +14 more

43.Velocidex / velociraptor

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security
• endpoint-protection
• endpoint-discovery
• +1 more

44.sbondCo / Watcharr

Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.

• go
• golang
• svelte
• sveltekit
• sqlite
• sqlite3
• +14 more

45.corazawaf / coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

• coraza
• waf
• coraza-waf
• owasp-crs
• modsecurity
• coreruleset
• +6 more

46.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

47.stakater / Reloader

A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!

• kubernetes
• openshift
• configmap
• secrets
• pods
• deployments
• +5 more

48.openziti / ziti

The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti

• networking
• vpn-2
• appsec
• network
• zero-trust
• zero-trust-cloud
• +14 more

49.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

50.open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

• opa
• policy
• declarative
• json
• compliance
• cloud-native
• +2 more

51.hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management

• vault
• go
• secrets

52.authzed / spicedb

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

• zanzibar
• permissions
• database
• distributed-systems
• security
• security-tools
• +12 more

53.kubeshark / kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

• kubernetes
• golang
• rest
• grpc
• devops
• sniffer
• +14 more

54.gravitl / netmaker

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

• wireguard
• vpn
• mesh
• zero-trust
• devsecops
• k8s
• +14 more

55.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

56.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

57.coipond / coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic
• coding-assistant
• containers
• +14 more

58.ory / hydra

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

• hydra
• oauth2
• openid-connect
• docker
• server
• security
• +14 more

59.cert-manager / cert-manager

Automatically provision and manage TLS certificates in Kubernetes

• kubernetes
• letsencrypt
• tls
• certificate
• crd
• hacktoberfest

60.future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

• vuls
• vulnerability-scanners
• golang
• go
• linux
• freebsd
• +14 more

61.OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go

• go
• pentesting
• tool
• dns
• web

62.dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

• oidc
• kubernetes
• idp
• identity-provider
• hacktoberfest

63.openbin-ai / binny

BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.

• ghidra
• llm-agent
• malware-analysis
• ollama
• reverse-engineering
• security-research

64.kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

• kubernetes
• security
• nsa
• mitre-attack
• devops
• best-practice
• +1 more

65.beelzebub-labs / beelzebub

A secure low code deception runtime framework, leveraging AI for System Virtualization.

• cybersecurity
• security
• honeypot
• framework
• go
• research-project
• +14 more

66.ory / kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

• identity
• identity-management
• user-management
• users
• user
• login
• +5 more

67.securego / gosec

Go security checker

• golang
• security
• security-tools
• security-automation
• static-analysis
• static-code-analysis

68.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

69.aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security
• golang
• docker
• +2 more

70.rudderlabs / rudder-server

Privacy and Security focused Segment-alternative, in Golang and React

• privacy
• warehouse-management
• data-warehouse
• customer-data
• customer-data-pipeline
• customer-data-platform
• +14 more

71.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

72.Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools
• security
• security-tools
• +13 more

73.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

74.google / syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

• linux
• kernel
• fuzz-testing
• fuzzing
• fuzzer
• testing
• +3 more

75.go-admin-team / go-admin

go-admin is a Gin + Vue starter kit for admin applications, supporting Element UI, Arco Design, and Ant Design. Features include multi-tenancy, user management, JWT authentication, RBAC, code generation, a form builder, and scheduled tasks. Build your own admin app in just 3 minutes.

• gin
• casbin
• gin-admin
• vue-admin
• gorm
• jwt
• +8 more

76.nhost / nhost

The Open Source Firebase Alternative with GraphQL.

• postgres
• hasura
• graphql
• authentication
• storage
• serverless-functions
• +13 more

77.rabbitstack / fibratus

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security
• etw
• blue-team
• +13 more

78.zitadel / oidc

Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation

• oidc
• oauth2
• openidconnect
• server
• client
• go
• +13 more

79.Zibbp / ganymede

Twitch VOD and Live Stream archiving platform. Includes a rendered and real-time chat for each archive.

• archive
• archived
• chat
• streaming
• twitch
• vod
• +4 more

80.screego / server

screen sharing for developers https://screego.net/

• webrtc
• screensharing-tool
• privacy
• selfhosted
• docker
• go

81.wader / fq

fq - jq for binary formats. Tool, language and decoders for working with binary formats.

• jq
• binary
• hexdump
• go
• json
• decode
• +7 more

82.yunginnanet / HellPot

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

• honeypot
• http
• web
• deception
• stress
• cross-platform
• +6 more

83.safedep / vet

Protect against malicious open source packages 🤖

• devsecops
• security
• supply-chain-security
• policy-as-code
• software-composition-analysis
• golang
• +5 more

84.NodePassProject / nodepass

A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections.

• api-rest
• connection-pooling
• cybersecurity
• devops
• golang
• http2
• +14 more

85.assetnote / h3fuzz

Content discovery and fuzzing with HTTP/3 support (100k requests per second)

86.cloudquery / cloudquery

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

• aws
• gcp
• azure
• sql
• data-integration
• elt
• +14 more

87.evilsocket / xrayArchived

XRay is a tool for recon, mapping and OSINT gathering from public networks.

• osint
• security
• network
• shodan
• intelligence
• mapping

88.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

89.go-jose / go-jose

An implementation of JOSE standards (JWE, JWS, JWT) in Go

90.apache / casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

• casbin
• access-control
• authorization
• rbac
• abac
• acl
• +12 more

91.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

92.aquasecurity / tfsec

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis
• ci
• aws
• +13 more

93.unkeyed / unkey

The Developer Platform for Modern APIs

• open-source
• authentication
• authorization
• gateway
• api
• api-keys
• +2 more

94.sensepost / gowitness

🔍 gowitness - a golang, web screenshot utility using Chrome Headless

• chrome
• headless
• screenshot
• security
• footprinting
• reporting
• +5 more

95.lukechilds / reverse-shell

Reverse Shell as a Service

• reverse-shell
• exploit
• vulnerability
• pentesting
• microservice
• security

96.GreenmaskIO / greenmask

Database anonymization and test data management

• golang
• obfuscation
• postgresql
• security
• security-tools
• anonymization
• +14 more

97.c9s / bbgo

The modern cryptocurrency trading bot framework written in Go.

• trading
• trading-bot
• cryptocurrency
• binance
• bitcoin
• crypto

98.SSLMate / certspotter

Lightweight Certificate Transparency Log Monitor

• certificate-transparency
• pki
• x509
• security
• webpki

99.Luzifer / ots

One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser

• one-time-secret
• golang
• encryption
• aes256

100.OpenNHP / opennhp

Make your infrastructure invisible to attackers. OpenNHP implements the Network-infrastructure Hiding Protocol (NHP): authenticate before connection, cryptographically. IETF draft.

• cybersecurity
• zero-trust
• zero-trust-network-access
• zero-trust-security