Trending repositories

1.affaan-m / ECC

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

• ai-agents
• anthropic
• claude
• claude-code
• developer-tools
• llm
• +2 more

2.alam00000 / bentopdf

The Privacy First PDF Toolkit

• jpgtopdf
• pdf
• pdf-converter
• pdf-generation
• pdf-viewer
• hacktoberfest
• +14 more

3.OWASP / CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

• owasp
• code
• security
• cheatsheets
• best-practices
• appsec
• +1 more

4.calesthio / Crucix

Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.

• ai
• intelligence
• osint

5.Piebald-AI / claude-code-system-prompts

All parts of Claude Code's system prompt, 27 builtin tool descriptions, sub agent prompts (Plan/Explore/Task), utility prompts (CLAUDE.md, compact, statusline, magic docs, WebFetch, Bash cmd, security review, agent creation). Updated for each Claude Code version.

• claude-code
• claude-code-system-prompts
• system-prompts

6.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

7.jason5ng32 / MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

• dns
• ip
• ipinfo
• network
• webrtc
• leaks
• +14 more

8.gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

• data-analysis
• data-manipulation
• encryption
• encoding
• compression
• parsing
• +1 more

9.qeeqbox / social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

• osint
• social-media
• analyzer
• username
• profile
• reconnaissance
• +13 more

10.gildas-lormeau / SingleFile

Web Extension for saving a faithful copy of a complete web page in a single HTML file

• browser
• archive
• auto-save
• chrome
• firefox
• offline-reading
• +12 more

11.HackTricks-wiki / hacktricks

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

• hacktricks
• pentesting
• hacking
• peass

12.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

13.lockfale / OSINT-Framework

OSINT Framework

• osint-framework
• osint-resources
• osint
• intelligence-gathering
• reconnaissance
• footprinting

14.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

15.yokoffing / Betterfox

Firefox user.js for optimal privacy and security. Your favorite browser, but better.

• firefox
• anti-tracking
• mozilla
• privacy
• security
• settings
• +5 more

16.arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

• privacy
• firefox
• security
• settings
• anti-fingerprinting
• arkenfox
• +2 more

17.apsdehal / awesome-ctf

A curated list of CTF frameworks, libraries, resources and softwares

• ctf
• awesome
• security
• penetration

18.cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

• xss
• sanitizer
• dom
• security
• javascript
• dompurify
• +5 more

19.dessant / buster

Captcha solver extension for humans, available for Chrome, Edge and Firefox

• browser-extension
• chrome-extension
• firefox-extension
• captcha
• recaptcha
• captcha-solving
• +1 more

20.TheAlgorithms / JavaScript

Algorithms and Data Structures implemented in JavaScript for beginners, following best practices.

• algorithm
• algorithm-challenges
• data-structures
• cryptography
• cipher
• search
• +8 more

21.sampotts / plyr

Deprecated in favour of Video.js 10; security updates only. Simple HTML5, YouTube and Vimeo player.

• html5-video
• youtube
• vimeo
• javascript
• plyr
• deprecated
• +1 more

22.motdotla / dotenv

Loads environment variables from .env for nodejs projects.

• dotenv
• environment-variables
• javascript
• node
• nodejs
• secrets
• +5 more

23.alephdata / aleph

Search and browse documents and data; find the people and companies you look for.

• python
• data-search
• graph-database
• journalism
• osint
• investigative-journalism

24.m0bilesecurity / RMS-Runtime-Mobile-Security

Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

• mobile-security
• android-security
• frida
• reverse-engineering
• ios-security

25.gatsbyjs / gatsby

React-based framework with performance, scalability, and security built in.

• gatsby
• static-site-generator
• react
• blog
• web-app
• compiler
• +1 more

26.amark / gun

An open source cybersecurity protocol for syncing decentralized graph data.

• machine-learning
• artificial-intelligence
• big-data
• blockchain
• p2p
• decentralized
• +14 more

27.Shuffle / Shuffle

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

• automation
• cybersecurity
• openapi
• shuffle
• security
• workflow-editor
• +9 more

28.KuroLabs / stegcloak

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

• cryptography
• steganography
• compression
• functional-programming
• ramdajs
• hacking-tool
• +10 more

29.digitalocean / nginxconfig.io

⚙️ NGINX config generator on steroids 💉

• nginx
• nginx-configuration
• php-fpm
• ssl
• letsencrypt
• cdn
• +14 more

30.sahat / hackathon-starter

A boilerplate for Node.js web applications

• hackathon
• boilerplate
• oauth2
• nodejs
• starter-kit
• hacktoberfest

31.panva / node-oidc-provider

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

• openid
• oidc
• openid-provider
• openid-connect
• connect
• server
• +4 more

32.forwardemail / forwardemail.net

Privacy-focused encrypted email for everyone. All-in-one alternative to Gmail + Mailchimp + Sendgrid.

• email
• forwarding
• forwarder
• free
• custom
• domain
• +11 more

33.WebDecoy / FCaptcha

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

• anti-bot
• behavioral-analysis
• bot-detection
• captcha
• fingerprinting
• go
• +14 more

34.electerious / Ackee

Self-hosted, Node.js based analytics tool for those who care about privacy.

• website-analytics
• analytics
• google-analytics
• privacy

35.RetireJS / retire.js

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

• vulnerabilities
• scanner
• firefox-extension
• grunt-plugins
• javascript
• vulnerable-libraries
• +8 more

36.auth0 / node-jsonwebtoken

JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

37.R74nCom / sandboxels

In-browser falling-sand simulation game with over 500 elements and thousands of reactions.

• browser-game
• cellular-automata
• cellular-automaton
• chemistry
• chemistry-lab
• falling-sand
• +14 more

38.josstei / maestro-orchestrate

Multi-agent orchestration platform for Gemini CLI, Claude Code, Codex, and Qwen Code — 39 specialists, parallel subagents, persistent sessions, and built-in code review, debugging, security, SEO, accessibility, and compliance tools

• agentic
• ai-agents
• code-review
• developer-tools
• gemini
• gemini-cli
• +14 more

39.jaredhanson / passport

Simple, unobtrusive authentication for Node.js.

• nodejs
• express
• passport
• oauth
• oauth2
• saml
• +2 more

40.momenbasel / keyFinder

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

• pentesting
• security
• chrome-extension
• api-keys
• api-security
• browser-extension
• +14 more

41.sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.

• capnproto
• decentralized
• sandstorm
• seccomp
• self-hosted
• self-hosting

42.digitalbazaar / forge

A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps

• crypto
• cryptography
• x509
• message-digest
• aes
• asn1
• +14 more

43.padloc / padloc

A modern, open source password manager for individuals and teams.

• javascript
• lit-element
• lit-html
• password-generator
• password-manager
• progressive-web-app
• +5 more

44.animir / node-rate-limiter-flexible

Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.

• security
• limit
• ratelimter
• bruteforce
• throttle
• koa
• +11 more

45.aquasecurity / cloudsploit

Cloud Security Posture Management (CSPM)

• aws
• security
• security-audit
• cloud
• azure
• cspm
• +5 more

46.ZYSzys / awesome-captcha

:key: Curated list of awesome captcha libraries and crack tools.

• captcha
• captcha-solving
• captcha-breaking
• captcha-generator
• captcha-image
• awesome
• +6 more

47.nccgroup / singularity

A DNS rebinding attack framework.

• dns-rebinding
• dns
• vulnerability
• attack
• iot

48.spothq / cryptocurrency-icons

A set of icons for all the main cryptocurrencies and altcoins, in a range of styles and sizes.

• icons
• coin
• bitcoin
• ethereum
• flat-icons
• altcoin
• +14 more

49.PrismarineJS / node-minecraft-protocol

Parse and serialize minecraft packets, plus authentication and encryption.

• network
• protocol
• minecraft
• server
• packets
• proxy
• +1 more

50.DFIRKuiper / Kuiper

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts
• parser
• digital-forensics

51.xFFFFF / Gekko-Strategies

Strategies to Gekko trading bot with backtests results and some useful tools.

• gekko
• strategies
• gekko-strategies
• gekko-backtest
• backtest-database
• cryptocurrency
• +14 more

52.cyb3rfox / Aurora-Incident-Response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

• incident-response
• incident-management
• incident-response-tooling

53.pompelmi / pompelmi

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

• clamscan
• file-scanner
• virus-scan
• docker-compose
• upload-file
• virus
• +8 more

54.HynekPetrak / javascript-malware-collection

Collection of almost 40.000 javascript malware samples

• malware-samples
• malware-research
• javascript
• malware-jail

55.travist / jsencrypt

A tiny (18.5 kB gzip), zero-dependency, Javascript library to perform OpenSSL RSA Encryption, Decryption, and Key Generation.

56.lirantal / is-website-vulnerable

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

• security-vulnerabilities
• security
• vulnerabilities
• lighthouse
• scan
• nodejs
• +1 more

57.nccgroup / house

A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

• frida
• mobile
• pentest-tool
• android

58.cure53 / H5SC

HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors

59.evilcos / xssor2

XSS'OR - Hack with JavaScript.

• probe
• pentest-tool
• xss
• csrf
• encoding
• hacking-tool
• +2 more

60.ehmicky / cross-platform-node-guide

📗 How to write cross-platform Node.js code

• windows
• unix
• linux
• macos
• portability
• cross-platform
• +14 more

61.boazeb / papervault

Paper vault for passwords and secrets

• cryptocurrency
• cryptography
• cybersecurity
• digital-asset-security
• password-manager

62.produck / svg-captcha

generate svg captcha in node

• captcha
• svg-captcha
• nodejs-captcha
• captcha-alternative
• captcha-generator

63.cuckoosandbox / cuckooArchived

Cuckoo Sandbox is an automated dynamic malware analysis system

64.offen / offen

Offen Fair Web Analytics

• privacy
• datensparsamkeit
• self-hosted
• web-analytics
• fair

65.dchest / tweetnacl-js

Port of TweetNaCl cryptographic library to JavaScript

• crypto
• javascript
• authentication
• signature
• elliptic-curves
• secretbox
• +9 more

66.dpnishant / appmonArchived

Documentation:

• android
• ios-app
• macos-app
• security-tools
• appmon
• reverse-engineering
• +3 more

67.lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues

• npm
• yarn
• lockfile
• lockfiles
• lint
• linter
• +2 more

68.patrickjuchli / basic-ftp

FTP client for Node.js, supports FTPS over TLS, passive mode over IPv6, async/await, and Typescript.

• ftp
• ftps
• async-await
• promise
• tls
• ipv6
• +2 more

69.SAP / cloud-active-defense

Add a layer of active defense to your cloud applications.

• cybersecurity
• deception
• decoy
• honeytoken
• infosec
• security

70.zakariagharzouli / sparda

AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.

• ai-agents
• ai-code-review
• authorization
• bola
• claude-code
• guardrails
• +4 more

71.simov / grant

OAuth Proxy

• nodejs
• javascript
• oauth
• oauth2
• authentication
• authorization
• +14 more

72.ExpressGateway / express-gateway

A microservices API Gateway built on top of Express.js

• api-gateway
• expressjs
• express-middleware
• microservices
• oauth2
• oauth2-server
• +6 more

73.joaomilho / Enterprise

🦄 The Enterprise™ programming language

• enterprise
• disruptive-technology
• language
• ajax
• cloud
• crypto
• +13 more

74.CapacitorSet / box-js

A tool for studying JavaScript malware.

• malware
• malwareanalysis
• nodejs
• es6
• javascript
• es6-proxies

75.zdhenard42 / SOC-Multitool

A powerful and user-friendly browser extension that streamlines investigations for security professionals.

• browser-extension
• chrome-extension
• cybersecurity
• threat-analysis
• threat-hunting
• threat-intelligence

76.Areizen / Android-Malware-Sandbox

Android Malware Sandbox

77.depado / goploader

Easy file sharing with server-side encryption, curl/httpie/wget compliant

• sharing
• self-hosted
• cryptography
• terminal
• curl

78.DePayFi / widgets

💸 Crypto Payments straight to your wallet. DePay simplifies Web3 integration for developers, harnessing DeFi to accept any token effortlessly. Integrate frictionless, real-time token conversion with sleek, customizable widgets designed for seamless user experience.

• blockchain
• payment
• widgets
• react
• web3
• crypto
• +5 more

79.0x742 / noia

[WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re).

• frida
• android
• security
• reverse-engineering
• android-security
• hacking-tools
• +4 more

80.doyensec / electronegativityArchived

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.

• security
• electron
• electron-app
• nodejs

81.dtjohnson / xlsx-populate

Excel XLSX parser/generator written in JavaScript with Node.js and browser support, jQuery/d3-style method chaining, encryption, and a focus on keeping existing workbook features and styles in tact.

• javascript
• excel
• xlsx

82.LewisArdern / bXSS

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

• xss
• bxss
• security
• bugbounty
• blueteam
• cross-site-scripting
• +1 more

83.hegusung / WebHashcat

Hashcat web interface

• hashcat
• cracking
• analytics
• pentesting
• password-cracking
• security-tools

84.brancogao / webhook-debugger

Capture, inspect, and replay webhooks with 90-day history + signature verification. Built on Cloudflare Workers + D1.

• cloudflare-workers
• d1
• debugger
• self-hosted
• serverless
• sqlite
• +14 more

85.web3swift-team / web3swift

Full featured library for Ethereum interaction with the JSON RPC API in swift. Native ABI parsing and smart contract interactions.

• web3
• web3js
• web3-dapp
• dapp
• ethereum
• json-rpc
• +10 more

86.vincentcox / StaCoAn

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

• bugbounty
• security
• security-tools
• mobile-security
• static-code-analysis

87.jesusprubio / strong-nodeArchived

:heavy_check_mark: More than 100 security checks for your Node.js API

88.ReversecLabs / dref

DNS Rebinding Exploitation Framework

• dns-rebinding
• red-team
• hacking
• web-hacking
• browser-hacking
• pentesting
• +3 more

89.HynekPetrak / malware-jail

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler
• javascript
• malware-jail
• +6 more

90.FCSC-FR / shovel

Web interface to explore Suricata EVE outputs

• attack-defense-ctf
• ctf
• network-monitor
• suricata
• ecsc
• ecsc2024
• +1 more

91.Cap-go / capacitor-autofill-save-password

Capacitor plugin to prompt to display dialog for saving password to keychain for iOS webview app.

• autofill
• capacitor
• ionic
• password
• capacitor-plugin

92.reZach / secure-electron-template

The best way to build Electron apps with security in mind.

• electron
• security
• template
• react
• redux
• webpack
• +2 more

93.iaincollins / nextjs-starterArchived

A starter project for Next.js with authentication

• javascript
• zeit
• demo
• react
• oauth
• passportjs
• +2 more

94.wwwtyro / crypticoArchived

An easy-to-use encryption system utilizing RSA and AES for javascript.

95.brannondorsey / whonow

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

• dns
• dns-rebinding
• hacking
• malicious-domains
• nodejs
• penetration-testing
• +2 more

96.brannondorsey / dns-rebind-toolkit

A front-end JavaScript toolkit for creating DNS rebinding attacks.

• dns-rebinding
• dns
• hacking
• red-team
• network-attacks
• iot
• +1 more

97.HR / CrypterArchived

🔓✨🔒 An innovative, convenient and secure encryption app

• crypto
• masterpass
• crypter
• cross-platform
• electron
• encyption
• +11 more

98.mafintosh / webcat

Mad science p2p pipe across the web using webrtc that uses your Github private/public key for authentication and a signalhub for discovery

99.JPCERTCC / SysmonSearch

Investigate suspicious activity by visualizing Sysmon's event log

• security
• kibana
• elasticsearch
• sysmon
• stix
• stix2

100.arcaneiceman / kraken

Kraken: A multi-platform distributed brute-force password cracking system

• kraken
• kraken-client
• security-tools
• security
• wpa2-cracking
• bruteforce-password-cracker
• +2 more