1.mdpsec / bug-bounty-hunting-prompts
Reusable prompts for a structured, evidence-first bug bounty hunting workflow
+749 stars
from 146 · score 6.62
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
15 repositories by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
+484 stars
from 22,656 · score 6.18
3.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+384 stars
from 15,032 · score 5.95
4.MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
+251 stars
from 21,845 · score 5.53
5.bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
+181 stars
from 11,022 · score 5.20
6.nahamsec / Resources-for-Beginner-Bug-Bounty-Hunters
A list of resources for those interested in getting started in bug bounties
+72 stars
from 12,241 · score 4.29
7.Hacker0x01 / hacker101
Source code for Hacker101.com - a free online web and mobile security class.
+68 stars
from 14,547 · score 4.23
8.infoslack / awesome-web-hacking
A list of web application security
+58 stars
from 7,279 · score 4.08
9.FrancescoStabile / numasec
The AI Agent for Cyber Security.
+33 stars
from 796 · score 3.53
10.momenbasel / htb-writeups
The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups
+32 stars
from 271 · score 3.50
11.lissy93 / domain-locker
🌐 The all-in-one tool, for keeping track of your domain name portfolio. Got domain names? Get Domain Locker!
+30 stars
from 1,529 · score 3.43
12.WebDecoy / FCaptcha
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
+10 stars
from 219 · score 2.40
13.lunasec-io / lunasec
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
+3 stars
from 1,470 · score 1.39
14.TypeError / secure
Modern Python library for HTTP security headers with safe defaults, configurable presets, and first-class ASGI/WSGI middleware (FastAPI, Django, Flask, Shiny, and more).
+3 stars
from 1,071 · score 1.39
15.bountyyfi / lonkero
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
+1 stars
from 1,098 · score 0.69