Global

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

SkillSpector helps you answer: "Is this skill safe to install?"

818 production-grade cybersecurity skills · 34 security domains · 6 framework mappings · 26+ AI platforms

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

is a CLI and library for evaluating and red-teaming LLM apps. Stop the trial-and-error approach - start shipping secure, reliable AI apps.

Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint (and more) for credentials? We have an enterprise product that can help! Learn more at .

WARNING] > Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only.

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet.

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities. com/oss-scanner.

Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows.

Database governance built for humans and agents — controlling changes and access across every major database.

@openai/codex-security is a CLI and TypeScript SDK for defining security policy and finding, validating, and fixing security vulnerabilities in your code.

Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies.

CAUTION] USE AT YOUR OWN RISK. BE EXTREMELY CAREFUL. This suite is > designed to generate and execute autonomously generated code that may be > unstable or perform unexpected actions.

Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. (demo )

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

1. Is this action allowed? An agent with access to sendemail and querydatabase should not be able to droptable.

This repository started as a way to document my journey on getting a better foundational knowledge of "DevOps". It was started on the 1st January 2022 and ran to the 31st March 2022 which is 90 Days!

We encourage users to help make these tools better by submitting issues when you find a bug or want a new feature. Check out our contributing overview and developer-specific documentation if you are interested in providing code contributions.

This open source repository contains the standard CodeQL libraries and queries that power GitHub Advanced Security and the other application security products that GitHub makes available to its customers worldwide.

This repo is not maintained and is not accepting contributions.

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab.

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

If you're looking for a managed service, you can get started with just a few clicks, visit netmaker.io to create your netmaker server.

0) — built to > run on any agent harness, not just Claude Code. This fork's focus: > harness portability, sandboxed (containerized) exploit validation, > and measured-impact PoCs. See > Why the changes · > What this fork changes · > The numbers.