Trending repositories

501.h3xduck / TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

• backdoor
• ebpf
• kernel
• rootkit
• security
• libbpf

502.OpenSCAP / openscap

NIST Certified SCAP 1.2 toolkit

• scap
• xccdf
• oval
• cpe
• compliance
• openscap
• +2 more

503.kost / dvcs-ripper

Rip web accessible (distributed) version control systems: SVN/GIT/HG...

504.jaksi / sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

• ssh
• honeypot
• go
• golang
• security

505.ev-flow / quark-engine

The repository host gives no description.

• defcon
• android
• blackhat
• blackbox
• malware-analysis
• malware-detection

506.matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data
• serverless
• apache-iceberg
• +14 more

507.profanity-im / profanity

Ncurses based XMPP client

• xmpp-client
• c
• xmpp
• chat
• ncurses
• decentralization
• +6 more

508.uNetworking / uSockets

Miniscule cross-platform eventing, networking & crypto for async applications

• miniscule
• cross-platform
• async
• tcp
• ssl

509.elastic / protections-artifacts

Elastic Security detection content for Endpoint

510.nccgroup / house

A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

• frida
• mobile
• pentest-tool
• android

511.fkie-cad / cwe_checker

cwe_checker finds vulnerable patterns in binary executables

• cwe
• binary-analysis
• static-analyzer
• vulnerability-scanner
• reverse-engineering
• program-analysis
• +4 more

512.apache / casbin-Casbin.NET

An authorization library that supports access control models like ACL, RBAC, ABAC in .NET (C#)

• casbin
• access-control
• authorization
• rbac
• abac
• acl
• +4 more

513.vanhoefm / fragattacks

The repository host gives no description.

514.greg7mdp / sparsepp

A fast, memory efficient hash map for C++

• hash-tables
• sparse-containers
• unordered
• sparsehash
• hashmap
• hash
• +2 more

515.step-security / harden-runner

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening
• security-hardening
• runners
• +3 more

516.AndroBugs / AndroBugs_FrameworkArchived

AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.

517.mildsunrise / protobuf-inspector

🕵️ Tool to reverse-engineer Protocol Buffers with unknown definition

• reverse-engineering
• protocol-buffers
• serialization

518.OpenIDC / mod_auth_openidc

OpenID Certified™ OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd

• apache-httpd
• openid-connect
• openidconnect-client
• openidc
• c
• authentication
• +3 more

519.in-toto / in-toto

in-toto is a framework to protect supply chain integrity.

• supply-chain
• security
• new-york-university
• secure-systems-lab

520.sonyxperiadev / ApkAnalyserArchived

The repository host gives no description.

521.TryCatchHCF / DumpsterFire

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

• pentesting
• hacking
• hacking-tool
• pentest-tool
• automation
• security
• +9 more

522.BcryptNet / bcrypt.net

BCrypt.Net - Bringing updates to the original bcrypt package

• blowfish
• bcrypt
• c-sharp
• algorithm
• hash
• netcore
• +6 more

523.RustCrypto / AEADs

Authenticated Encryption with Associated Data Algorithms: high-level encryption ciphers

524.paulmillr / noble-curves

Audited & minimal JS implementation of elliptic curve cryptography.

• crypto
• cryptography
• ecdsa
• ed25519
• ed448
• eddsa
• +14 more

525.Hakky54 / certificate-ripper

🔐 A CLI tool to extract server certificates

• certificate
• ssl
• x509
• tls
• java
• macos
• +7 more

526.RustCrypto / password-hashes

Password hashing functions / KDFs

527.RustCrypto / elliptic-curves

Collection of pure Rust elliptic curve implementations: NIST P-224, P-256, P-384, P-521, secp256k1, SM2

• ecdsa
• nist
• rust
• schnorr
• taproot

528.counteractive / incident-response-plan-template

A concise, directive, specific, flexible, and free incident response plan template

• incident-response
• incident
• incident-management
• infosec
• information-security
• cybersecurity

529.panva / oauth4webapi

Low-Level OAuth 2 / OpenID Connect Client API for JavaScript Runtimes

• oauth2
• openid
• openid-connect
• oidc
• authentication
• authorization
• +10 more

530.openxpki / openxpki

OpenXPKI Code

• pki
• enterprise-software
• workflow-based
• x509
• hsm-support
• opensource-pki
• +1 more

531.pompelmi / pompelmi

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

• clamscan
• file-scanner
• virus-scan
• docker-compose
• upload-file
• virus
• +8 more

532.XKCP / XKCP

eXtended Keccak Code Package

533.in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

• security-tools
• security
• attestation
• verification
• supply-chain

534.mushorg / glastopf

Web Application Honeypot

535.algolia / sup3rS3cretMes5age

Simple to use, simple to deploy, one time self destruct messaging service, with hashicorp vault as a backend

• golang
• vault
• security
• secrets
• hashicorp-vault

536.go-jose / go-jose

An implementation of JOSE standards (JWE, JWS, JWT) in Go

537.struppigel / PortEx

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

538.maaaaz / androwarn

Yet another static code analyzer for malicious Android applications

539.OneKeePass / desktop

A secure password manager for macOS,Linux and Windows platforms

540.paulmillr / noble-ciphers

Audited & minimal JS implementation of Salsa20, ChaCha and AES

• aes-siv
• chacha20
• chacha20-poly1305
• chacha20poly1305
• cipher
• cryptography
• +11 more

541.kpcyrd / authoscope

Scriptable network authentication cracker

• rust
• cracking
• lua
• dictionary-attack
• concurrency
• password
• +2 more

542.log2timeline / dftimewolf

A framework for orchestrating forensic collection, processing and data export

543.jasonish / docker-suricata

A Suricata Docker image.

• suricata
• ids
• nsm
• docker
• container
• podman

544.gsmith257-cyber / GraphCrawlerArchived

GraphQL automated security testing toolkit

• api
• automated-testing
• cybersecurity
• graphql
• graphql-api
• pentesting
• +2 more

545.avaneev / komihash

Very fast, high-quality hash function, discrete-incremental and streamed hashing-capable (non-cryptographic, header-only C/C++) 27GB/s + PRNG

• hash
• hashing
• hashing-algorithm
• hash-function
• hash-table
• prng
• +14 more

546.OneKeePass / mobile

A secure password manager for iOS and Android platforms

547.dogoncouch / LogESP

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management
• security
• security-tools
• +14 more

548.node9-ai / node9-proxy

Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.

• ai-safety
• ai-security
• claude-code
• llm-agent
• agent-security
• dlp
• +14 more

549.Juliusolsson05 / pharos-ai

Open-source OSINT intelligence dashboard tracking the Iran conflict in real time — live DeckGL/MapLibre conflict map, 30 bias-labeled feeds, actor dossiers, and daily briefs. Live at conflicts.app.

• deckgl
• geopolitics
• intelligence
• maplibre
• nextjs
• osint
• +1 more

550.RaffaDNDM / HacknDroid

Automation of some MAPT activities and interaction with the mobile Android device.

• android-analysis
• frida
• mobile-hacking
• mobile-penetration-testing
• mobile-pentest
• mobile-pentest-toolkit
• +3 more

551.omar2535 / GraphQLer

🔍A cutting edge context aware GraphQL API fuzzing tool!

• api-testing-framework
• graphql
• api
• automated-testing
• cybersecurity
• pentesting
• +3 more

552.rod-chapman / SPARKNaCl

SPARK 2014 re-implementation of the TweetNaCl crypto library

553.JoasASantos / php2shell-scanner

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

• crtsh
• cve
• cve-2026-109618
• cve-2026-109619
• php
• php-security
• +4 more

554.eunomia-bpf / ActPlane

eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness

• ebpf
• harness
• ifc
• policy-engine

555.squidKid-deluxe / QTradeX-Algo-Trading-SDK

AI-powered SDK featuring algorithmic trading, backtesting, deployment on 100+ exchanges, and multiple optimization engines.

• ai
• algorithmic-trading
• crypto
• machine-learning
• python
• trading-platform
• +13 more

556.bombinisecurity / bombini

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security
• kernel
• runtime-security
• +6 more

557.bad-antics / nullkia

NullKia Mobile Security Framework - Tools in Nim, Crystal, V, D, Red, Odin, Haxe, Zig, Kotlin, Lua, PHP, Python | bad-antics | github.com/bad-antics

• android-hacking
• baseband
• bootloader-unlock
• checkm8
• firmware-hacking
• ios-jailbreak
• +14 more

558.shrec / UltrafastSecp256k1

Ultra high-performance secp256k1 ECC engine | Python, Node.js, Rust, Go, C#, Swift, Java bindings | CUDA, Metal, OpenCL GPU | ECDSA, Schnorr, FROST, MuSig2, BIP-352 | 15+ platforms

• cryptography
• cuda
• riscv
• secp256k1
• arm64
• opencl
• +14 more

559.stefanoviana / deepalpha

AI crypto trading bot with deep neural network (84.9% accuracy, 25 coins). BiLSTM + Attention trained on GPU. Bybit, Binance, OKX, Gate.io. Free cloud or self-hosted.

• algorithmic-trading
• lightgbm
• machine-learning
• trading-bot
• bybit
• crypto
• +14 more

560.hookprobe / hookprobe

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security
• ips
• open-source-security
• +14 more

561.chrislusf / seaweedfs

SeaweedFS is a fast distributed storage system for blobs, objects, files, and data lake, for billions of files! Blob store has O(1) disk seek, cloud tiering. Filer supports Cloud Drive, xDC replication, Kubernetes, POSIX FUSE mount, S3 API, S3 Gateway, Hadoop, WebDAV, encryption, Erasure Coding. Enterprise version is at seaweedfs.com.

562.anpa1200 / adversarygraph

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.

• cybersecurity
• docker
• fastapi
• llm
• mitre-attack
• react
• +14 more

563.dromara / Sa-Token

Translated✨ An open-source, free, one-stop Java permission authentication framework that makes authentication and authorization simple and elegant! — Login authentication, permission authentication, distributed Session, microservice gateway authentication, SSO single sign-on, OAuth2.0 unified authentication, jwt integration, API Key authorization, API parameter signing

• java
• token
• authorization
• sso
• aouth2
• springcloud

564.SpecterOps / BloodHound-Legacy

Six Degrees of Domain Admin

565.nginx-proxy / acme-companion

Automated ACME SSL certificate generation for nginx-proxy

• nginx-proxy
• letsencrypt
• docker
• ssl
• acme
• acme-v2
• +3 more

566.JesusFreke / smaliArchived

smali/baksmali

567.dwisiswant0 / apkleaks

Scanning APK file for URIs, endpoints & secrets.

• mobile-security
• android-security
• reverse-engineering
• bugbounty
• static-analysis
• apk
• +2 more

568.longld / peda

PEDA - Python Exploit Development Assistance for GDB

569.openpgpjs / openpgpjs

OpenPGP implementation for JavaScript

570.coorasse / cancancan

The authorization Gem for Ruby on Rails.

• authorization
• cancancan
• rails

571.weidai11 / cryptopp

free C++ class library of cryptographic schemes

• cryptography
• crypto
• c-plus-plus

572.digitalbazaar / forge

A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps

• crypto
• cryptography
• x509
• message-digest
• aes
• asn1
• +14 more

573.SpiderLabs / ResponderArchived

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

574.aws / s2n-tls

An implementation of the TLS/SSL protocols

• tls
• ssl
• s2n
• encryption
• c
• c99
• +2 more

575.aarondl / authboss

The boss of http auth.

576.linuxserver / docker-swag

Nginx webserver and reverse proxy with php support and a built-in Certbot (Let's Encrypt) client. It also contains fail2ban for intrusion prevention.

• hacktoberfest

577.lynndylanhurley / devise_token_auth

Token based authentication for Rails JSON APIs. Designed to work with jToker and ng-token-auth.

• devise
• rails
• authentication
• api
• oauth
• omniauth

578.bitwarden / desktopArchived

The desktop vault (Windows, macOS, & Linux).

• bitwarden
• javascript
• typescript
• angular
• electron

579.django-oauth / django-oauth-toolkit

OAuth2 goodies for the Djangonauts!

• python
• django
• oauth2

580.github / secure_headers

Manages application of security headers with many safe defaults

• secure-headers
• csp
• hsts
• referrer-policy
• rack
• middleware
• +4 more

581.Security-Onion-Solutions / security-onionArchived

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

• intrusion-detection
• network-security-monitoring
• log-management
• ids
• nsm
• hunting
• +1 more

582.ac-pm / Inspeckage

Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

• android-application
• security-analysis
• dynamic-analysis
• xposed

583.oauthlib / oauthlib

A generic, spec-compliant, thorough implementation of the OAuth request-signing logic

• python
• python3
• python-3
• authentication
• library
• oauth
• +10 more

584.christophetd / CloudFlair

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

• cloudflare
• pentest-tool
• pentest
• censys

585.rubysec / bundler-audit

Patch-level verification for Bundler

• bundler-audit
• ruby-advisory-db
• ruby
• dependency-checker
• patch-management
• security
• +2 more

586.google / enjarifyArchived

The repository host gives no description.

587.flipkart-incubator / Astra

Automated Security Testing For REST API's

• security
• restapiautomation
• python
• owasp
• penetration-testing-framework
• postman-collection
• +4 more

588.coreos / go-oidc

A Go OpenID Connect client.

• golang

589.sans-blue-team / DeepBlueCLI

The repository host gives no description.

590.byt3bl33d3r / SILENTTRINITYArchived

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

• security-tools
• c-sharp
• dotnet
• ironpython
• python3
• red-teams
• +4 more

591.404labfr / laravel-impersonate

Laravel Impersonate is a plugin that allows you to authenticate as your users.

• laravel-package
• impersonate
• php
• user-management
• laravel

592.Storyyeller / Krakatau

Java decompiler, assembler, and disassembler

593.ruby-oauth / oauth2

🔐 oauth2 - A Ruby wrapper for the OAuth 2.0, & 2.1 Authorization Frameworks, including OpenID Connect (OIDC)

• authentication
• authorization
• oauth2
• oauth2-client
• security
• oidc
• +1 more

594.hlandau / acmetool

:lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)

• acmetool
• certificate
• acme-server
• acme
• letsencrypt
• ssl
• +2 more

595.antonioribeiro / google2fa

A One Time Password Authentication package, compatible with Google Authenticator.

• php
• 2fa
• two-factor-authentication
• google2fa
• agnostic
• hacktoberfest
• +1 more

596.google / rekallArchived

Rekall Memory Forensic Framework

597.dfunckt / django-rules

Awesome Django authorization, without the database

• python
• django
• permissions
• rules
• predicates
• authorization

598.jeremyevans / rodauth

Ruby's Most Advanced Authentication Framework

599.openshift / osin

Golang OAuth2 server library

600.qvest-digital / loginsrv

JWT login microservice with plugable backends such as OAuth2, Google, Github, htpasswd, osiam, ..

• jwt
• htpasswd
• service
• golang
• caddy
• caddyserver
• +3 more