security
The MITRE Fight Fraud Framework™ (F3) is a curated knowledge base of tactics and techniques used by financial fraud actors, derived from real-world observations of cyber fraud incidents. The framework includes behaviors that characterize known fraud TTPs and references existing MITRE ATT&CK® cyber techniques as applicable to financial fraud. F3 provides a common structure and taxonomy to consistently describe and enumerate the material events of a cyber fraud incident, enabling stronger collaboration on fraud prevention, detection, and response across organizational teams. The knowledge base is globally accessible, open, and available at no charge to any person or organization.
Related contents:
How to disable JavaScript in your browser.
Nowadays almost all web pages contain JavaScript, a scripting programming language that runs arbitrary code, through the web browser, on the visitor's computer. It is supposed to make web pages functional for specific purposes but it has proven its potential to cause significant harm to users time and time again:
Datadog Static AI Security Testing (SAIST) tool.
Code Security scans your first-party code and open source libraries used in your applications in both your repositories and running services, providing end-to-end visibility from development to production.
Related contents:
Collection of npm package manager Security Best Practices.
Shai-Hulud, Nx and other incidents are a growing concern of supply chain security attacks and compromised npm packages. Follow these developer security best practices around npm, package maintenance and secure local development to mitigate security risks.
Open-Source API Security Testing Framework.
API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates.
Hadrian is an open-source API security testing framework that detects OWASP API Top 10 vulnerabilities in REST, GraphQL, and gRPC APIs. It uses role-based authorization testing and YAML-driven templates to automatically find broken object-level authorization (BOLA), broken function-level authorization (BFLA), broken authentication, and other critical API security flaws — without writing custom test code.
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Runtime governance for AI agents — the only toolkit covering all 10 OWASP Agentic risks with 9,500+ tests. Governs what agents do, not just what they say — deterministic policy enforcement, zero-trust identity, execution sandboxing, and SRE — Python · TypeScript · .NET · Rust · Go
Related contents:
The Container Security Platform. Application Kernel for Containers.
gVisor provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a Linux-like interface. Unlike Linux, it is written in a memory-safe language (Go) and runs in userspace.
gVisor includes an Open Container Initiative (OCI) runtime called runsc that makes it easy to work with existing container tooling. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.
Full autonomy. Controlled environment. OS-level containment for AI coding agents on macOS.
macOS containment for AI agents — user isolation, kernel sandbox, pf firewall, DNS blocklist, backup/rollback. TLA+ verified.
AI coding agents are most useful when you let them work autonomously. But full autonomy means the agent runs with your full privileges, your credentials, your files.
Hazmat makes that safe.
Related contents:
The Open Cybersecurity Schema Framework (OCSF) is an open standard for cybersecurity event logging and data normalization. The framework is made up of a set of categories, event classes, data types, and an attribute dictionary. It is not restricted to cybersecurity nor to events, however the initial focus of the framework has been a schema for cybersecurity events.
Related contents:
JamfHound is a python3 project designed to collect and identify attack paths in Jamf Pro tenants based on existing object permissions by outputting data as JSON for ingestion into BloodHound.
Related contents:
AWS silently updates Managed IAM policies all the time. We catch every single change.
Security auditing CLI for web applications.
VICE is a security auditing CLI tool that finds vulnerabilities in your web applications. It has two modes:
Remote scan gives it a URL. It crawls your site with a real browser, extracts secrets from JS bundles, tests your login for brute force and SQL injection, scans your VPS ports, checks your Supabase RLS, and more. Like an attacker would, but on your own systems.
Local audit points it at your project directory. It reads your source code, checks your .env files, runs npm audit, analyzes your Supabase migrations for missing RLS, finds SQL injections and XSS in your code, and tells you exactly what to fix.
Enterprise governance for AI agents — scan, enforce, and audit every skill, MCP server, and plugin before it runs.
DefenseClaw is the enterprise governance layer for OpenClaw. It sits between your AI agents and the infrastructure they run on, enforcing a simple principle: nothing runs until it's scanned, and anything dangerous is blocked automatically.
Organisation fédérant les pratiquants de la lecture sportive de journaux serveurs bruts, dans l'optique d'inscrire le sport comme discipline officielle aux Jeux Olympiques.
Organization uniting practitioners of sportive reading of raw server logs, with a view to registering the sport as an official discipline to the Olympic Games.
Go hard on agents, not on your filesystem. easy containment for AI agents.
Use jai for effortless containment of AI agents on Linux. jai strives to be the easiest container in the world to configure--so easy that you never again need to run a code assistant without protection. It's not a substitute for docker or podman when you need better isolation. But if you regularly do risky things like run an AI CLI with your own privileges in your home directory on a computer that you care about, then jai could reduce the damage when things go wrong.
The policy-and-trust layer for MCP tool servers. Turn YAML configs into validated, policy-enforced MCP tools.
Heddle turns declarative configs into Model Context Protocol servers with trust enforcement, credential brokering, and tamper-evident audit logging built in.
layerleak the Docker Hub Secret Scanner.
Traditional secret scanners often treat a container image as a flat blob or depend on a local Docker daemon. This project is designed around OCI image internals
734 Cybersecurity Skills for AI Agents. 734+ AI-Ready Skills for Claude Code & More.
The largest open-source library of structured cybersecurity skills following the agentskills.io standard. Deploy instantly to Claude Code, GitHub Copilot, Cursor, and 26+ platforms.
A golang implementation of endlessh (SSH tarpit) exporting Prometheus metrics, visualized by a Grafana dashboard.
A Better Secrets Scanner. Detect Leaked API Keys & Credentials. A Better Secrets Scanner built for configurability and speed.
Betterleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and whatever else you wanna throw at it via stdin. If you wanna learn more about how the detection engine works check out this blog: Regex is (almost) all you need.
Related contents:
Tool to guess CPE name based on common software name.
CPE Guesser is a command-line tool or web service designed to guess the CPE name based on one or more keywords. The resulting CPE can then be used with tools like cve-search or vulnerability-lookup to perform actual searches using CPE names.
Related contents:
Turn SOC Noise into Real Signals. Autonomous SOC Platform.
Qevlar AI investigates every alert like your top analyst would. So your SOC focuses on real threats, not alert firefighting.
Related contents:
Secure, ephemeral browsing in a disposable VM (macOS only).
Bromure is a native macOS app that runs every browser session inside a lightweight, disposable Linux virtual machine using Apple's Virtualization.framework. The browser and your Mac don't share an operating system, a filesystem, or even a kernel. When you close the window, the VM is destroyed -- cookies, history, malware, trackers, all of it. Gone.
Bagel is a cross-platform CLI that inspects developer workstations and produces a structured report of security findings. It allows developers to understand their attack surface and what could be of interest to a malicious actor.
Related contents:
Open-source EDR for AI agents. Monitor processes, files, network, and behavior of autonomous AI agents.
Aegis is an open-source endpoint detection and response (EDR) tool that monitors AI agent processes, file access, network activity, and behavioral anomalies in real time. Built with Electron 33, Svelte 5, and TypeScript, it provides the same class of oversight for autonomous AI agents that CrowdStrike provides for traditional endpoints. No telemetry. No cloud. Everything stays local.
🤖 Dependabot's core logic for creating update PRs.
Related contents:
Hide .env secrets from prAIng eyes.
secrets live in local encrypted stores (per project) and are injected directly into apps at runtime, never touching disk as plaintext.
Related contents:
Semgrep Pro Rules to ensure code using LLMs is following best practices.
Semgrep rules that catch common trust & safety mistakes in LLM-powered applications. Scan any codebase in seconds to find hardcoded API keys, missing safety checks, prompt injection risks, and unhandled errors across all major AI providers.
Local Privilege Escalation, as a Graph.
A BloodHound OpenGraph collector that models Windows local privilege escalation as interconnected attack paths.
Automatically load secrets from your preferred vault as environment variables or files, and clear them once your shell command is over.
Lade (/leɪd/) is a tool allowing you to automatically load secrets from your preferred vault into environment variables or files. It limits the exposure of secrets to the time the command requiring the secrets lives.
Related contents:
Unified Security Platform from Code to Runtime.
Protect against malicious code installed via npm, yarn, pnpm, npx, and pnpx with Aikido Safe Chain. Free to use, no tokens required.
Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.
Threat Designer is an AI-driven agent that automates and streamlines the threat modeling process for secure system design. Harnessing the power of large language models (LLMs), it analyzes system architectures, identifies potential security threats, and generates detailed threat models—empowering developers and security professionals to incorporate security from the earliest stages of development.
Launched in 2016, the HTTP Observatory enhances web security by analyzing compliance with best security practices. It has provided insights to over 6.9 million websites through 47 million scans.
Related contents:
Network monitoring tool that maps process-to-network connections, identifies cloud providers, and detects beaconing activity. Zero-flag agent binary for deployment, aggregation server, offline ASN lookup.
Related contents:
mquire, a play on the memory and inquire words, is a memory querying tool inspired by osquery.
Zero-dependency Linux memory forensics PoC — leverages kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
Related contents:
Extensible MacOS system telemetry generator.
MacNoise is an extensible and modular macOS system telemetry generation framework. It generates real system events (network connections, file writes, process spawns, plist mutations, TCC permission probes, and more) so security teams can validate that their EDR, SIEM, and firewall tooling detects what it is supposed to detect.
Related contents:
CredData (Credential Dataset) is a set of files including credentials in open source projects. CredData includes suspicious lines with manual review results and more information such as credential types for each suspicious line.
CredData can be used to develop new tools or improve existing tools. Furthermore, using the benchmark result of the CredData, users can choose a proper tool among open source credential scanning tools according to their use case. We sincerely hope that CredData will help minimize credential leaks.
Related contents:
CredSweeper is an advanced credential detection tool designed to identify exposed credentials such as passwords, API keys, tokens, and other sensitive information across source code, configuration files, documents, and binary assets. CredSweeper scans regular files, embedded data in containers, and files added in Git commits. The tool combines pattern-based detection, machine learning–based validation, and deep file inspection to deliver comprehensive and accurate security scanning for modern codebases and repositories.
Related contents:
Security proxy for AI agents. Scans every message for prompt injection, PII, and secrets. Defense-in-depth: Go proxy + iptables firewall + eBPF kernel monitor. YAML policy engine, audit logging, 5 AI agents with RAG knowledge bases.
Security proxy for AI agents. Sits in front of OpenClaw and scans every message for prompt injection, PII leaks, and secrets — before they reach the model or leave the network.
MCP security testing framework for evaluating Model Context Protocol server vulnerabilities.
A Model Context Protocol (MCP) server built with FastMCP that provides various tools including Claude AI integration, text injection capabilities, and server information utilities. It is definitely super secure, you should definitely send confidential data through it, and definitely take everything it says as fact.
Related contents:
No-Code Security Automation Platform. Workflow automation for Security Teams.
ShipSec Studio provides a visual DSL and runtime for building, executing, and monitoring automated security workflows. It decouples security logic from infrastructure management, providing a durable and isolated environment for running security tooling at scale.
High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 459 detection rules with live credential validation.
Caterpillar is a security scanning library for AI agent skill files (e.g., Claude Code skills) for dangerous or malicious behavior.
Security scanner for AI agent skills. Scans for malicious patterns before you install.
Monitor your local neighbourhood's bluetooth activity.
Bluetooth Neighborhood - Track BLE devices in your area and analyze traffic patterns.
Related contents:
LLM Vulnerability Scanner.
Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction.
Related contents:
Your browser catches homograph attacks. Your terminal doesn't. Tirith guards the gate — intercepts suspicious URLs, ANSI injection, and pipe-to-shell attacks before they execute.
(Rogue Office 365 and Azure (active) Directory tools)
A collection of Azure AD/Entra tools for offensive and defensive security purposes.
ROADtools is a framework to interact with Azure AD. It consists of a library (roadlib) with common components, the ROADrecon Azure AD exploration tool and the ROADtools Token eXchange (roadtx) tool.
Related contents:
CAPSlock is an offline Conditional Access (CA) analysis tool built on top of a roadrecon database. It helps defenders, auditors, and red teams understand how Conditional Access policies actually behave, not just how they are configured.
Related contents:
Implementing Open Source Security Tooling into your CI/CD Pipeline
Securing your Continuous Integration and Continuous Deployment (CI/CD) pipeline is no longer optional—it’s essential. This guide is your go-to resource for building, implementing, and optimizing secure CI/CD workflows. Whether you’re a developer, DevOps engineer, or security professional, we provide information on the open-source tools and guidance you need to model security at every stage of your pipeline. From securing code and builds to monitoring post-deployment environments, our hub empowers teams to integrate security seamlessly into their workflows without sacrificing speed or agility. Explore, learn, and transform your CI/CD processes into a fortress of innovation and resilience.
Related contents:
Security Scanner for Agent Skills.
A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines pattern-based detection (YAML + YARA), LLM-as-a-judge, and behavioral dataflow analysis for comprehensive threat detection.
Related contents:
Fine-grained authorization for AI agents using OpenFGA.
AI agents are getting access to production systems - databases, APIs, file systems. But who decides what they can do? Traditional RBAC wasn't designed for autonomous agents that make decisions without human approval.
Related contents:
Fine-Grained Authorization. A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar
Relationship-based access control made fast, scalable, and easy to use.
OpenFGA is an open-source authorization solution that allows developers to build granular access control using an easy-to-read modeling language and friendly APIs.
Related contents:
Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.
Related contents:
LLM Service Fingerprinting Tool.
Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 30+ other AI services in seconds.
Julius is an LLM service fingerprinting tool for security professionals. It detects which AI server software is running on network endpoints during penetration tests, attack surface discovery, and security assessments.
Unlike model fingerprinting tools that identify which LLM generated text, Julius identifies the server infrastructure: Is that endpoint running Ollama? vLLM? LiteLLM? A Hugging Face deployment? Julius answers in seconds.
Related contents:
The bridge between Burp Suite and modern AI.
Burp AI Agent is an extension for Burp Suite that integrates AI capabilities into your security workflow.
Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
Related contents:
Minimal CVE Hardened container image collection.
A collection of production-ready container images with minimal CVEs, rebuilt daily using Chainguard's apko and Wolfi packages. By including only required packages, these images maintain a reduced attack surface and typically have zero or near-zero known vulnerabilities.
Related contents:
SysWarden is a tool based on the Data-Shield IPv4 Blocklists Community, Wazuh and Fail2ban that blocks up to 99% of noisy, disruptive, and malicious IP addresses and focuses on real signals.
Related contents:
Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances,...
Related contents:
Matchlock secures AI agent workloads with a Linux-based sandbox.
Matchlock is a CLI tool for running AI agents in ephemeral microVMs - with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Your secrets never enter the VM.
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Cyberbro is an open-source threat intelligence and indicator analysis platform. Whether you're a new user or a seasoned developer, this documentation will help you get started, configure, and make the most of Cyberbro's features.
Related contents: