Ranked by Attention Score: stars gained over the last 90 complete days
37 repositories by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Find secrets with Gitleaks 🔑
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
Find, verify, and analyze leaked credentials
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
The AI Agent for Cyber Security.
Database governance built for humans and agents — controlling changes and access across every major database.
Blazing-fast remote access
Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.
An authoritative list of awesome devsecops tools with the help from community experiments and contributions.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Skills and career roadmap for various security roles like application security, cloud security, DevSecOps, security engineer, security researchers, pentesting, api security, network security, mobile security and so on with helpful resources, guidelines
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.
Tfsec is now part of Trivy
Protect against malicious open source packages 🤖
:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:
Open Source Cloud Native Application Protection Platform (CNAPP)
Real-time secret-leak guardrails for AI coding agents (Claude Code, Codex), Git hooks, and CI.
Zero-code K8s sidecar for log sanitization. Detects secrets via Entropy Analysis, preserves JSON integrity, and redacts PII deterministically. 🛡️
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
🔥Open source RASP solution
Give the agent a cage, not your keys. One-command Docker sandbox for AI coding agents: full autonomous permissions, per-project isolation, your host stays untouched.
Audit and fix your Mac's security in one command. No agent, no signup, open source.
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
Safe access to production databases