security
SDLC Infrastructure Threat Framework
A comprehensive framework for understanding and mitigating supply chain security threats across the Software Development Lifecycle infrastructure.
Related contents:
AI-powered subdomain enumeration tool with local LLM analysis via Ollama - 100% private, zero API costs.
God's Eye is a powerful, ultra-fast subdomain enumeration and reconnaissance tool written in Go. It combines multiple passive sources with active DNS brute-forcing and comprehensive security checks to provide a complete picture of a target's attack surface.
Related contents:
Secure SSH bastion & PAM/NSS modules for LemonLDAP::NG - Centralized SSH & sudo access control with SSO integration.
Control SSH access and sudo privileges on your Linux servers through a centralized bastion server.
Open Bastion integrates your servers with LemonLDAP::NG (LLNG) to centrally manage who can SSH into which servers and who can use sudo. Administrators define access rules in the portal, and the PAM/NSS modules enforce them on each server.
Related contents:
OpenSource compliance CLI for GitLab CI/CD.
Analyze your GitLab CI/CD pipelines for security and compliance: pipeline composition (templates, components, version constraints), container images (mutable tags, trusted registries), and branch protection settings.
Plumber is a compliance scanner for GitLab. It reads your .gitlab-ci.yml and repository settings, then checks for security and compliance issues.
Related contents:
Scan websites for exposed Supabase JWTs, enumerate accessible tables, and detect sensitive data exposure automatically.
A Python script that scans websites for exposed Supabase JWT tokens, enumerates accessible database tables, and analyzes them for sensitive data exposure. The script automatically detects sensitive information (emails, passwords, API keys, PII, financial data, etc.) and classifies vulnerability levels to identify which tables pose security risks.
Hunt Smarter, Hunt Harder.
Active Directory Security Analysis Platform.
ADTrapper is a comprehensive security analysis platform designed for cybersecurity professionals to analyze Windows Active Directory authentication logs. The platform provides advanced threat detection, anomaly analysis, and interactive visualizations to help identify and investigate security incidents.
Production-ready, Dockerized MCP (Model Context Protocol) servers for offensive security tools. Enable AI assistants like Claude to perform security assessments, vulnerability scanning, and binary analysis.
A high-speed covert tunnel that disguises TCP traffic as SMTP email communication to bypass Deep Packet Inspection (DPI) firewalls.
Related contents:
Open-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing.
Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail (Google Workspace) to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction.
Exploration into public Certificate Transparency Logs.
Real-time Certificate Transparency log explorer. Watch newly issued TLS certificates appear as they're published to public CT logs. CertTrack monitors Certificate Transparency logs in real-time, showing you newly issued TLS certificates as they appear. You can watch the stream of certificates, filter by domain, and explore the details of each certificate.
Related contents:
A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE.
IDE Shepherd is a security extension for VS Code and Cursor IDEs that provides real-time runtime protection against malicious extensions and supply chain attacks. Using advanced require-in-the-middle (RITM) instrumentation, IDE Shepherd intercepts Node.js primitives at the module loading layer, enabling comprehensive monitoring and blocking of suspicious network requests, process executions, dynamic code evaluation, and workspace tasks.
Related contents:
AI Code Security Anti-Patterns distilled from 150+ sources to help LLMs generate safer code.
A comprehensive security reference distilled from 150+ sources to help LLMs generate safer code.
Related contents:
Brakeman Security Scanner. Secure Your Rails Applications
Brakeman is a free vulnerability scanner designed for Ruby on Rails applications. Statically analyze Rails application code to find security issues at any stage of development.
News on data leaks in France
Secure visual editor for .env files that masks sensitive secrets while allowing easy editing.
Dotenv Mask Editor provides a table-based interface for .env files. It is designed to reduce the accidental exposure of sensitive values by masking strings that meet a length threshold. All processing is done locally within your editor.
Related contents:
aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured Salesforce Experience Cloud applications as well as automates much of the testing process. Some of it's functionality includes:
Related contents:
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows.
Related contents:
AWS Attack Path Scanner. Discover privilege escalation paths across 10+ AWS services.
Heimdall is an AWS security scanner that discovers privilege escalation paths attackers could exploit to gain admin access.
Related contents:
NGINX Configuration Security & Hardening Scanner.
Gixy-Next (Gixy) is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls before they reach production. It is an actively maintained fork of Yandex's Gixy. Gixy-Next's source code is available on GitHub.
Related contents:
Advanced Kubernetes Architecture Security Tool.
This tool allows to perform the reconstruction of complex attack paths by graph generation in a Kubernetes cluster. It uses Neo4j for the storage of objects and relationships in database as well as neodash for visualization. The language Cypher as MySQL allows queries to the database to retrieve graphs. It can be used by security auditors to quickly identify attack paths or security experts to monitor theses paths.
Related contents:
A powerful Burp Suite extension for JavaScript static analysis. Extracts API endpoints, URLs, secrets, and email addresses from JavaScript files with intelligent noise filtering. The goal is reduce noise as much as possible to ensure the accuracy
A framework for finding JavaScript memory leaks and analyzing heap snapshots. Analyzes JavaScript heap and finds memory leaks in browser and node.js.
Related contents:
Security, visibility, and authorization for AI agents
Leash wraps AI coding agents in containers and monitors their activity. You define policies in Cedar; Leash enforces them instantly.
Authorize and monitor your AI agents with policy enforcement, sandboxed execution, and real-time observability—ensuring they operate safely within your defined boundaries.
A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.
This repository contains intentionally vulnerable implementations of Model Context Protocol (MCP) servers (both local and remote). Each server lives in its own folder and includes a dedicated README.md with full details on what it does, how to run it, and how to demonstrate/attack the vulnerability.
threat modelling configuration language with hcl.
There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth word documents, to fully instrumented threat models in a centralised solution. Two of the most valuable attributes of a threat model are being able to clearly document the threats, and to be able to drive valuable change.
A security auditor for Tailscale configurations. Scans your tailnet for misconfigurations, overly permissive access controls, and security best practice violations.
Protect your SSH keys with your Mac's Secure Enclave.
Secretive is an app for protecting and managing SSH keys with the Secure Enclave.
Related contents:
High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478).
A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components.
AI Penetration Testing.
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
An IP based remember-me to allow auth interactions on dumb clients. Targeted at self-hosters who don't want to directly expose things like HomeAssistant or Jellyfin login pages to the open internet but have clients that can't support web auth
Find, analyze, and check for exposed IP cameras with open ports, known vulnerabilities, and weak login credentials.
CamXploit is a reconnaissance tool designed to help researchers and security enthusiasts check if an IP address is hosting an exposed CCTV camera. It scans common camera ports, checks for login pages, tests default credentials, and provides useful search links for further investigation.
paranoid-grade rust-based encryption utility + cross-platform GUI.
Related contents:
A local AI-powered DLP solution.
PrivacyFirewall is a local-first PII and secrets firewall for AI tools like ChatGPT, Claude, and Gemini.It blocks risky paste events, warns as you type, and (optionally) uses a lightweight on-device Transformer model for deeper PII detection.
Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | SLSA Level 3 Compliant for Secure Development and Build Process | Apps Available on MS Store✨
Related contents:
Build better security habits, one test at a time. Quickly assess open source projects for risky practices.
Related contents:
Hands-on MCP security lab: 10 real incidents reproduced with vulnerable/secure MCP servers, pytest regressions, and Claude/Cursor battle-tested exploit walkthroughs
Grype + Rummage = Grummage.
Grummage is an interactive terminal frontend to Grype.
Related contents:
pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify version annotations.
age-encrypted secrets for NixOS and Home manager.
agenix is a small and convenient Nix library for securely managing and deploying secrets using common public-private SSH key pairs: You can encrypt a secret (password, access-token, etc.) on a source machine using a number of public SSH keys, and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys.
Related contents:
Analyze Chrome Extensions for Security.
CRXplorer is a free Chrome extensions analysis tool that combines traditional security scanning with AI-powered insights.
Related contents:
Basic rate-limiting middleware for the Express web server.
Use to limit repeated requests to public APIs and/or endpoints such as password reset. Plays nice with express-slow-down and ratelimit-header-parser.
GreyNoise watches the internet's background radiation—the constant storm of scanners, bots, and probes hitting every IP address on Earth. We've cataloged billions of these interactions to answer one critical question: is this IP a real threat, or just internet noise? Security teams trust our data to cut through the chaos and focus on what actually matters.
Related contents:
Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning and web cache deception.
The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.
Kubernetes Compliance & Security Checks Extension. Browser extension for Kubernetes YAML guardrails – security & compliance linting directly in GitHub/GitLab.
Guardon is a lightweight browser extension that helps developers and reviewers detect common Kubernetes misconfigurations and security issues directly on code hosting sites (GitHub, GitLab, Bitbucket) or from pasted YAML. It parses multi-document YAML, applies configurable rules, and can suggest safe fixes.
Related contents:
Open Source Cloud Security Scanner.
An open source, cloud-native security to protect everything from build to runtime.
cnspec assesses your entire infrastructure's security and compliance. It finds vulnerabilities and misconfigurations across public and private cloud environments, Kubernetes clusters, containers, container registries, servers, endpoints, SaaS products, infrastructure as code, APIs, and more.
A powerful policy as code engine, cnspec is built upon Mondoo's security data fabric. It comes configured with default security policies that run right out of the box. It's both fast and simple to use!
An executable file that runs a harmless program most of the time, but will run a different, hidden code if deployed on a specific target host.
Related contents:
A web-based management interface for CrowdSec security stack with Pangolin integration. This project replaces the bash script with a modern, user-friendly ShadcnUI built with Go and React.
Sirius is an open-source comprehensive vulnerability scanner that leverages community-driven security intelligence and automated penetration testing capabilities.
A RISC-V instruction set extension for privacy-oriented programming. Mojo-V allows programmers to write software that computes on data that no software or person can see, except the data owner. Mojo-V implements this novel form of secret computation using simple extensions to a RISC-V CPU.
The Volatility Collaborative GUI.
A modern, distributed web interface for collaborative memory forensics built on Volatility 3, Django, and Dask.
Free Malware Scanner for Linux Servers.
Find out what’s hiding on your server, absolutely free. Your first step to a secure server starts here.
Related contents:
Scan MCP servers for potential threats & security findings.
A Python tool for scanning MCP (Model Context Protocol) servers and tools for potential security findings. The MCP Scanner combines Cisco AI Defense inspect API, YARA rules and LLM-as-a-judge to detect malicious MCP tools.
Related contents:
The AI Penetration Testing Agent. Penetration testing done in hours, not weeks. Strix finds and fixes vulnerabilities before they reach production.
Your Complete Security Operations Platform
Open-source SIEM, CSPM, WAF, and threat intelligence. From git clone to running security scans in just 5 minutes. No vendor lock-in. No complex setup.
Security Orchestrator for Advanced Response to Cyber Attacks.
The Open Source CACAO-based Security Orchestrator! Automate threat and incident response workflows with CACAO security playbooks.
Related contents:
ENISA, is the Union's agency dedicated to achieving a high common level of cybersecurity across Europe.
Related contents:
Vulnerabilities in modern computers leak passwords and sensitive data.
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware vulnerabilities allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.
An advanced AI-driven vulnerability scanner and penetration testing tool that integrates multiple AI providers (OpenAI, Grok, OLLAMA, Claude) with comprehensive security testing modules for automated bug hunting, intelligent payload generation, and professional reporting.
Related contents:
A simulation tool for AWS IAM written in Go.
yams is a Go library, server, and CLI providing foundational capabilities to simulate access for AWS IAM policies.
A Kubernetes controller and tool for one-way encrypted Secrets.
Problem: "I can manage all my K8s config in git, except Secrets." Solution: Encrypt your Secret into a SealedSecret, which is safe to store - even inside a public repository. The SealedSecret can be decrypted only by the controller running in the target cluster and nobody else (not even the original author) is able to obtain the original Secret from the SealedSecret.
Related contents: