1.NationalSecurityAgency / ghidra
Ghidra is a software reverse engineering (SRE) framework
- software-analysis
- disassembler
- reverse-engineering
+26,104 stars
from 71,438 · score 10.17
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
1–100 of 283 by Attention Score · Aug 6, 2026 – Nov 3, 2026 (UTC)
2.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
- agents
- artificial-intelligence
- cybersecurity
- penetration-testing
- ai-penetration-testing
- ai-pentesting
- +14 more
+25,154 stars
from 48,439 · score 10.13
3.NVIDIA / SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
- agent-security
- agent-skills
- agentic-ai
- ai-security
- claude-code
- mcp
- +5 more
+10,101 stars
from 14,107 · score 9.22
4.pranshuparmar / witr
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
+3,966 stars
from 18,949 · score 8.29
5.iBotPeaches / Apktool
A tool for reverse engineering Android apk files
- apktool
- apk
- android
- reverse-engineering
- arsc
- 9patch
+1,882 stars
from 25,096 · score 7.54
+1,819 stars
from 49,740 · score 7.51
7.aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
- security
- security-tools
- docker
- containers
- vulnerability-scanners
- vulnerability-detection
- +9 more
+1,814 stars
from 37,130 · score 7.50
8.keycloak / keycloak
Open Source Identity and Access Management For Modern Applications and Services
- keycloak
- oidc
- saml
+1,774 stars
from 35,909 · score 7.48
9.NVIDIA / garak
the LLM vulnerability scanner
- ai
- llm-evaluation
- llm-security
- security-scanners
- vulnerability-assessment
+1,208 stars
from 8,641 · score 7.10
10.microg / GmsCore
Free implementation of Play Services
+1,173 stars
from 14,010 · score 7.07
11.authelia / authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
- totp
- ldap
- sso-authentication
- two-factor-authentication
- docker
- kubernetes
- +14 more
+1,106 stars
from 28,389 · score 7.01
12.mytechnotalent / Reverse-Engineering
A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.
- reverse-engineering
- hacking
- x86
- x64
- assembly
- assembly-language
- +14 more
+1,091 stars
from 14,001 · score 7.00
13.gchq / CyberChef
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
- data-analysis
- data-manipulation
- encryption
- encoding
- compression
- parsing
- +1 more
+898 stars
from 35,413 · score 6.80
14.homarr-labs / homarr
A modern and easy to use dashboard. 80+ integrations. 20K+ icons built in. Authentication out of the box. No YAML, drag and drop configuration.
+867 stars
from 4,418 · score 6.77
15.kopia / kopia
Cross-platform backup tool for Windows, macOS & Linux with fast, incremental backups, client-side end-to-end encryption, compression and data deduplication. CLI and GUI included.
- deduplication
- backup
- google-cloud-storage
- encryption
- cloud
+833 stars
from 13,737 · score 6.73
16.InsForge / InsForge
The all-in-one, open-source backend platform for agentic coding. InsForge gives your coding agent database, auth, storage, compute, hosting, and AI gateway to ship full-stack apps end-to-end.
- ai
- ai-agents
- coding
- oauth2
- postgresql
- deno
- +7 more
+822 stars
from 12,460 · score 6.71
17.openssl / openssl
General purpose TLS and crypto library
- cryptography
- openssl
- encryption
- tls
- ssl
- decryption
+730 stars
from 30,453 · score 6.59
18.casdoor / casdoor
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
+701 stars
from 14,049 · score 6.55
19.google / osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
+694 stars
from 10,688 · score 6.54
20.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
- security
- security-tools
- security-audit
- security-hardening
- hardening
- aws
- +14 more
+673 stars
from 14,489 · score 6.51
21.goharbor / harbor
An open source trusted cloud native registry project that stores, signs, and scans content.
- cncf
- container
- registry
- helm
- cloud-native
- containers
- +6 more
+640 stars
from 29,024 · score 6.46
22.zaproxy / zaproxy
The ZAP by Checkmarx Core project
+622 stars
from 15,477 · score 6.43
23.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
- authorization
- permissions
- security
- zanzibar
- openfga
- entitlements
- +11 more
+553 stars
from 5,532 · score 6.32
24.anchore / grype
A vulnerability scanner for container images and filesystems
- containers
- security
- vulnerability
- docker
- golang
- go
- +9 more
+523 stars
from 12,647 · score 6.26
25.rathole-org / rathole
A lightweight and high-performance reverse proxy for NAT traversal, written in Rust. An alternative to frp and ngrok.
+479 stars
from 13,930 · score 6.17
26.google / oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
- fuzzing
- security
- stability
- oss-fuzz
- fuzz-testing
- vulnerabilities
+449 stars
from 12,463 · score 6.11
27.mandiant / flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
+404 stars
from 8,879 · score 6.00
28.open-policy-agent / opa
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
- opa
- policy
- declarative
- json
- compliance
- cloud-native
- +2 more
+377 stars
from 12,048 · score 5.93
+368 stars
from 13,900 · score 5.91
30.apache / caldera
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
- mitre-attack
- security-testing
- +1 more
+340 stars
from 7,149 · score 5.83
31.ozeranskii / httptap
Rich-powered CLI that breaks each HTTP request into DNS, connect, TLS, wait, and transfer phases with waterfall timelines, compact summaries, or metrics-only output.
- cli
- diagnostics
- http
- http2
- monitoring
- networking
- +5 more
+338 stars
from 509 · score 5.83
32.hslatman / awesome-threat-intelligence
A curated list of Awesome Threat Intelligence resources
- security
- awesome
- hacktoberfest
- awesome-list
+336 stars
from 10,486 · score 5.82
33.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+332 stars
from 9,218 · score 5.81
34.SoftEtherVPN / SoftEtherVPN
Cross-platform multi-protocol VPN software. Pull requests are welcome. The stable version is available at https://github.com/SoftEtherVPN/SoftEtherVPN_Stable.
- vpn-tunnel
- vpn-protocols
- softether-vpn
- vpn
- vpn-server
- ssl-vpn
- +12 more
+308 stars
from 13,397 · score 5.73
35.kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
- kubernetes
- security
- nsa
- mitre-attack
- devops
- best-practice
- +1 more
+301 stars
from 11,541 · score 5.71
36.corazawaf / coraza
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
- coraza
- waf
- coraza-waf
- owasp-crs
- modsecurity
- coreruleset
- +6 more
+291 stars
from 3,701 · score 5.68
37.nearai / ironclaw
IronClaw is an Agent OS focused on privacy, security and extensibility
+281 stars
from 12,430 · score 5.64
38.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+276 stars
from 4,874 · score 5.62
39.stakater / Reloader
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
- kubernetes
- openshift
- configmap
- secrets
- pods
- deployments
- +5 more
+272 stars
from 10,273 · score 5.61
40.authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
- zanzibar
- permissions
- database
- distributed-systems
- security
- security-tools
- +12 more
+272 stars
from 6,920 · score 5.61
41.cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
+263 stars
from 17,239 · score 5.58
42.foundry-rs / foundry
Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.
- rust
- solidity
- evm
- testing
- fuzzing
- blockchain
- +14 more
+262 stars
from 10,489 · score 5.57
43.alphacep / vosk-api
Offline speech recognition API for Android, iOS, Raspberry Pi and servers with Python, Java, C# and Node
- speech-recognition
- asr
- voice-recognition
- speech-to-text
- android
- ios
- +14 more
+257 stars
from 14,969 · score 5.55
44.meirwah / awesome-incident-response
A curated list of tools for incident response
+251 stars
from 9,278 · score 5.53
45.ashishb / android-security-awesome
A collection of android security related resources
+249 stars
from 9,564 · score 5.52
46.dexidp / dex
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
- oidc
- kubernetes
- idp
- identity-provider
- hacktoberfest
+248 stars
from 10,981 · score 5.52
47.androguard / androguard
Reverse engineering and pentesting for Android applications
- android
- dalvik
- reverse-engineering
- dex
- odex
- pentesting
+242 stars
from 6,160 · score 5.49
48.bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
- terraform
- static-analysis
- aws
- gcp
- azure
- aws-security
- +7 more
+237 stars
from 8,894 · score 5.47
49.ory / hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
- hydra
- oauth2
- openid-connect
- docker
- server
- security
- +14 more
+218 stars
from 17,428 · score 5.39
50.dromara / Sa-Token
✨ 开源、免费、一站式 Java 权限认证框架，让鉴权变得简单、优雅！—— 登录认证、权限认证、分布式 Session 会话、微服务网关鉴权、SSO 单点登录、OAuth2.0 统一认证、jwt 集成、API Key 秘钥授权、API 参数签名
- java
- token
- authorization
- sso
- aouth2
- springcloud
+213 stars
from 18,895 · score 5.37
51.apache / casbin
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
- casbin
- access-control
- authorization
- rbac
- abac
- acl
- +12 more
+212 stars
from 20,263 · score 5.36
52.firezone / firezone
Blazing-fast remote access
+209 stars
from 8,954 · score 5.35
53.PyCQA / bandit
Bandit is a tool designed to find common security issues in Python code.
- linter
- bandit
- security-tools
- security-scanner
- security
- static-code-analysis
- +1 more
+200 stars
from 8,170 · score 5.30
54.dwisiswant0 / apkleaks
Scanning APK file for URIs, endpoints & secrets.
- mobile-security
- android-security
- reverse-engineering
- bugbounty
- static-analysis
- apk
- +2 more
+200 stars
from 6,178 · score 5.30
55.mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
- malware-analysis
- reverse-engineering
- binary-analysis
- threat-intelligence
- gsoc-2026
+188 stars
from 6,111 · score 5.24
56.ory / kratos
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
- identity
- identity-management
- user-management
- users
- user
- login
- +5 more
+178 stars
from 13,771 · score 5.19
57.cert-manager / cert-manager
Automatically provision and manage TLS certificates in Kubernetes
- kubernetes
- letsencrypt
- tls
- certificate
- crd
- hacktoberfest
+172 stars
from 13,974 · score 5.15
58.gojue / ecapture
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
+171 stars
from 15,359 · score 5.15
59.aya-rs / aya
Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.
+171 stars
from 4,721 · score 5.15
60.ValueCell-ai / valuecell
ValueCell is a community-driven, multi-agent platform for financial applications.
- agentic-ai
- agents
- ai
- assitant
- crypto
- equity
- +6 more
+157 stars
from 10,885 · score 5.06
61.google / nsjail
A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.
+157 stars
from 4,024 · score 5.06
62.OpenNHP / opennhp
Make your infrastructure invisible to attackers. OpenNHP implements the Network-infrastructure Hiding Protocol (NHP): authenticate before connection, cryptographically. IETF draft.
- cybersecurity
- zero-trust
- zero-trust-network-access
- zero-trust-security
+147 stars
from 13,806 · score 5.00
63.openziti / ziti
The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti
- networking
- vpn-2
- appsec
- network
- zero-trust
- zero-trust-cloud
- +14 more
+146 stars
from 4,322 · score 4.99
64.arkime / arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
- network-monitoring
- pcap
- packet-capture
- nsm
- javascript
- c
- +2 more
+139 stars
from 7,418 · score 4.94
65.CTFd / CTFd
CTFs as you need them
+139 stars
from 6,757 · score 4.94
66.antonio-morales / Fuzzing101
An step by step fuzzing tutorial. A GitHub Security Lab initiative
+126 stars
from 3,800 · score 4.84
67.lief-project / LIEF
LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
- reverse-engineering
- malware-analysis
- binary-analysis
- parser
- modification
- executable-formats
- +13 more
+125 stars
from 5,503 · score 4.84
68.JonathanSalwan / Triton
Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
- reverse-engineering
- symbolic-execution
- binary-analysis
- program-analysis
- taint-analysis
- binary-translation
- +5 more
+123 stars
from 4,236 · score 4.82
69.kubeshark / kubeshark
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
- kubernetes
- golang
- rest
- grpc
- devops
- sniffer
- +14 more
+121 stars
from 12,005 · score 4.80
70.str4d / rage
A simple, secure and modern file encryption tool (and Rust library) with small explicit keys, no config options, and UNIX-style composability.
- cli
- encryption
- zero-configuration
- secure-by-default
- unix-philosophy
- curve25519
- +5 more
+118 stars
from 3,591 · score 4.78
71.securego / gosec
Go security checker
- golang
- security
- security-tools
- security-automation
- static-analysis
- static-code-analysis
+116 stars
from 8,881 · score 4.76
72.mandiant / flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
- malware
- deobfuscation
- strings
- flare
- malware-analysis
- gsoc-2026
+115 stars
from 4,094 · score 4.75
73.pglombardo / PasswordPusher
🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.
+111 stars
from 3,131 · score 4.72
74.google / syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
- linux
- kernel
- fuzz-testing
- fuzzing
- fuzzer
- testing
- +3 more
+106 stars
from 6,281 · score 4.67
75.cilium / hubble
Hubble - Network, Service & Security Observability for Kubernetes using eBPF
+106 stars
from 4,270 · score 4.67
76.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+101 stars
from 4,562 · score 4.62
77.googleapis / google-api-nodejs-client
Google's officially supported Node.js client library for accessing Google APIs. Support for authorization and authentication with OAuth 2.0, API Keys and JWT (Service Tokens) is included.
- google-api
- nodejs
- client
- client-library
+97 stars
from 12,189 · score 4.58
78.static-web-server / static-web-server
A cross-platform, high-performance and asynchronous web server for static files-serving. ⚡
- rust-lang
- http-server
- docker-image
- static-web-server
- file-server
- linux
- +14 more
+93 stars
from 2,303 · score 4.54
79.JetBrains / fernflower
Decompiler from Java bytecode to Java, used in IntelliJ IDEA.
- java
- decompiler
- reverse-engineering
+91 stars
from 4,343 · score 4.52
80.openiddict / openiddict-core
Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
- openidconnect
- oauth2
- aspnetcore
- dotnet
+88 stars
from 5,203 · score 4.49
81.OWASP / www-project-agent-memory-guard
Runtime defense against memory poisoning in AI agents (OWASP ASI06). Drop-in for LangChain, OpenAI Agents, AutoGen, CrewAI and mem0.
+88 stars
from 107 · score 4.49
82.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+84 stars
from 442 · score 4.44
83.tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
- linux
- aix
- +14 more
+83 stars
from 1,424 · score 4.43
84.linkerd / linkerd2
Ultralight, security-first service mesh for Kubernetes. Main repo for Linkerd 2.x.
- service-mesh
- rust
- golang
- kubernetes
- linkerd
- cloud-native
+79 stars
from 11,443 · score 4.38
85.openappsec / openappsec
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.
- api-security
- application-security
- kubernetes
- nginx
- web-application-firewall
- appsec
- +9 more
+79 stars
from 1,665 · score 4.38
86.cloud-custodian / cloud-custodian
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
+78 stars
from 6,028 · score 4.37
87.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+77 stars
from 1,475 · score 4.36
88.in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
- security-tools
- security
- attestation
- verification
- supply-chain
+75 stars
from 539 · score 4.33
89.GreenmaskIO / greenmask
Database anonymization and test data management
- golang
- obfuscation
- postgresql
- security
- security-tools
- anonymization
- +14 more
+70 stars
from 1,730 · score 4.26
90.quay / clair
Vulnerability Static Analysis for Containers
- containers
- static-analysis
- go
- kubernetes
- docker
- oci
- +3 more
+67 stars
from 11,018 · score 4.22
91.zitadel / oidc
Easy to use OpenID Connect client and server library written for Go and certified by the OpenID Foundation
+66 stars
from 1,854 · score 4.20
92.astrid-runtime / astrid
Astrid is a portable, capability-secure operating system for composable software.
+65 stars
from 10,225 · score 4.19
93.google / timesketch
Collaborative forensic timeline analysis
+65 stars
from 3,383 · score 4.19
94.elceef / dnstwist
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
+64 stars
from 5,708 · score 4.17
95.ashvardanian / StringZilla
Up to 100x faster strings for C, C++, CUDA, Python, Rust, Swift, JS, & Go, leveraging NEON, AVX2, AVX-512, SVE, GPGPU, & SWAR to accelerate search, hashing, sorting, edit distances, sketches, and memory ops 🦖
+63 stars
from 3,520 · score 4.16
96.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+62 stars
from 1,664 · score 4.14
97.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+60 stars
from 1,235 · score 4.11
98.gabrie30 / ghorg
Quickly clone or backup massive amounts of org/users repositories into one directory - Supports GitHub, GitLab, Bitbucket, and more 🐇🥚
+59 stars
from 2,105 · score 4.09
99.apereo / cas
Apereo CAS - Identity & Single Sign On for all earthlings and beyond.
- sso-authentication
- authentication
- authorization
- java
- websso
- saml2
- +14 more
+58 stars
from 11,337 · score 4.08
100.jwtk / jjwt
Java JWT: JSON Web Token for Java and Android
- jwt
- java
- java-jwt
- jjwt
- jwt-token
- jwt-tokens
- +14 more
+58 stars
from 11,081 · score 4.08