1.OWASP / CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
+1,133 stars
from 32,703 · score 7.03
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
32 repositories by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
2.jason5ng32 / MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
+925 stars
from 11,356 · score 6.83
3.projectdiscovery / nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
+578 stars
from 12,689 · score 6.36
4.yokoffing / Betterfox
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
+333 stars
from 10,629 · score 5.81
5.arkenfox / user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
+286 stars
from 12,662 · score 5.66
6.apsdehal / awesome-ctf
A curated list of CTF frameworks, libraries, resources and softwares
+276 stars
from 11,685 · score 5.62
7.cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
+264 stars
from 17,235 · score 5.58
8.Shuffle / Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
+92 stars
from 2,375 · score 4.53
9.KuroLabs / stegcloak
Hide secrets with invisible characters in plain text securely using passwords 🧙🏻♂️⭐
+89 stars
from 3,843 · score 4.50
10.digitalocean / nginxconfig.io
⚙️ NGINX config generator on steroids 💉
+83 stars
from 28,176 · score 4.43
11.WebDecoy / FCaptcha
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
+50 stars
from 179 · score 3.93
12.RetireJS / retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
+48 stars
from 4,149 · score 3.89
13.momenbasel / keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
+38 stars
from 692 · score 3.66
14.animir / node-rate-limiter-flexible
Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.
+31 stars
from 3,568 · score 3.47
15.aquasecurity / cloudsploit
Cloud Security Posture Management (CSPM)
+30 stars
from 3,756 · score 3.43
16.DFIRKuiper / Kuiper
Digital Forensics Investigation Platform
+15 stars
from 898 · score 2.77
17.pompelmi / pompelmi
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
+14 stars
from 667 · score 2.71
18.lirantal / is-website-vulnerable
finds publicly known security vulnerabilities in a website's frontend JavaScript libraries
+11 stars
from 2,031 · score 2.48
19.ehmicky / cross-platform-node-guide
📗 How to write cross-platform Node.js code
+8 stars
from 1,415 · score 2.20
20.SAP / cloud-active-defense
Add a layer of active defense to your cloud applications.
+5 stars
from 106 · score 1.79
21.zakariagharzouli / sparda
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
+5 stars
from 4 · score 1.79
22.ExpressGateway / express-gateway
A microservices API Gateway built on top of Express.js
+4 stars
from 3,025 · score 1.61
23.0x742 / noia
[WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re).
+4 stars
from 125 · score 1.61
24.doyensec / electronegativityArchived
Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.
+3 stars
from 1,049 · score 1.39
25.LewisArdern / bXSS
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
+3 stars
from 575 · score 1.39
26.brancogao / webhook-debugger
Capture, inspect, and replay webhooks with 90-day history + signature verification. Built on Cloudflare Workers + D1.
+3 stars
from 12 · score 1.39
27.vincentcox / StaCoAn
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
+2 stars
from 868 · score 1.10
28.reZach / secure-electron-template
The best way to build Electron apps with security in mind.
+1 stars
from 1,708 · score 0.69
29.HR / CrypterArchived
🔓✨🔒 An innovative, convenient and secure encryption app
+1 stars
from 466 · score 0.69
30.JPCERTCC / SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
+1 stars
from 431 · score 0.69
31.arcaneiceman / kraken
Kraken: A multi-platform distributed brute-force password cracking system
+1 stars
from 330 · score 0.69
32.kalpetros / hawkpass
Secure diceware passphrase generator
+1 stars
from 65 · score 0.69