1.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
+1,348 stars
from 71,883 · score 7.21
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
47 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.mukul975 / Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
+392 stars
from 35,012 · score 5.97
3.NPMscan / npmscan-action
Catch risky npm dependency changes before they merge.
+350 stars
from 170 · score 5.86
4.salemalem / npmscan-mcp-plugin
NPMscan MCP Plugin
+338 stars
from 171 · score 5.83
5.openqodex / openqodex
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
+309 stars
from 784 · score 5.74
6.morluto / awesome-reverse-engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
+268 stars
from 1,233 · score 5.59
7.ImranR98 / Obtainium
Get Android app updates straight from the source.
+253 stars
from 20,874 · score 5.54
8.gitleaks / gitleaks
Find secrets with Gitleaks 🔑
+250 stars
from 30,325 · score 5.53
9.Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
+212 stars
from 29,989 · score 5.36
10.mitmproxy / mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
+198 stars
from 46,344 · score 5.29
11.x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
+115 stars
from 50,023 · score 4.75
12.kenryu42 / cc-safety-net
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
+93 stars
from 1,790 · score 4.54
13.winsiderss / systeminformer
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com
+62 stars
from 16,331 · score 4.14
14.anchore / grype
A vulnerability scanner for container images and filesystems
+48 stars
from 13,107 · score 3.89
15.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
+46 stars
from 4,043 · score 3.85
16.nmap / nmap
Nmap - the Network Mapper. Github mirror of official SVN repository.
+38 stars
from 13,875 · score 3.66
17.rizinorg / cutter
Free and Open Source Reverse Engineering Platform powered by rizin
+35 stars
from 20,092 · score 3.58
18.monero-project / monero
Monero: the secure, private, untraceable cryptocurrency
+21 stars
from 10,949 · score 3.09
19.PyCQA / bandit
Bandit is a tool designed to find common security issues in Python code.
+19 stars
from 8,347 · score 3.00
20.matomo-org / matomo
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
+13 stars
from 21,982 · score 2.64
21.coipond / coi
Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.
+11 stars
from 759 · score 2.48
22.momenbasel / htb-writeups
The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups
+11 stars
from 292 · score 2.48
23.securego / gosec
Go security checker
+9 stars
from 8,986 · score 2.30
24.RetireJS / retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
+7 stars
from 4,190 · score 2.08
25.antonio-morales / Fuzzing101
An step by step fuzzing tutorial. A GitHub Security Lab initiative
+7 stars
from 3,919 · score 2.08
26.Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
+7 stars
from 2,772 · score 2.08
27.presidentbeef / brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications
+5 stars
from 7,287 · score 1.79
28.safedep / vet
Protect against malicious open source packages 🤖
+5 stars
from 1,118 · score 1.79
29.sorkila / lockpaw
Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.
+5 stars
from 165 · score 1.79
30.meta / pyre-checkArchived
Performant type-checking for python.
+4 stars
from 7,177 · score 1.61
31.node9-ai / node9-proxy
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
+4 stars
from 219 · score 1.61
32.trimstray / nginx-admins-handbook
How to improve NGINX performance, security, and other important things.
+3 stars
from 14,334 · score 1.39
33.cider-security-research / cicd-goat
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
+2 stars
from 2,325 · score 1.10
34.nccgroup / sobelow
Security-focused static analysis for the Phoenix Framework
+2 stars
from 1,796 · score 1.10
35.microsoft / DevSkim
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
+2 stars
from 1,015 · score 1.10
36.gmh5225 / awesome-llvm-security
awesome llvm security [Welcome to PR]
+2 stars
from 888 · score 1.10
37.crenoxhq / crenox
Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.
+2 stars
from 29 · score 1.10
38.michenriksen / gitrobArchived
Reconnaissance tool for GitHub organizations
+1 stars
from 6,197 · score 0.69
39.find-sec-bugs / find-sec-bugs
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
+1 stars
from 2,452 · score 0.69
40.lunasec-io / lunasec
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
+1 stars
from 1,472 · score 0.69
41.dvershinin / gixy
NGINX configuration static analyzer
+1 stars
from 1,189 · score 0.69
42.pompelmi / pompelmi
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
+1 stars
from 680 · score 0.69
43.Firstp1ck / Pacsea
Fast TUI for searching, inspecting, and queueing pacman/AUR packages.
+1 stars
from 302 · score 0.69
44.BA-CalderonMorales / terminal-jarvis
In the midst of all the tools out there that you can possibly use to keep track of them. Here's a "shovel" that just works to try them all out.
+1 stars
from 138 · score 0.69
45.cpeoples / ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
+1 stars
from 11 · score 0.69
46.getveil / veil
Keep your secrets out of your AI coding agents. A local HTTPS proxy that swaps real credentials with placeholders and injects them at the network boundary.
+1 stars
from 9 · score 0.69
47.zakariagharzouli / sparda
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
+1 stars
from 8 · score 0.69