Topics / #appsec

Appsec projects on GitHub

Application security covering testing, hardening and common vulnerability prevention.

As of , the most-starred Appsec projects on GitHub are shannon (49K stars), sqlmap (38.7K stars) and CheatSheetSeries (33.7K stars). GitHub.Locker tracks 16 Appsec repositories with 293.6K stars combined. The fastest-growing on October 16 was shannon, with +81 stars in a day.

16Projects
293.6KStars in total
+233Stars in a day
Browse in the catalog →github.com/topics/appsec ↗

Hot right now

Most stars gained in a day · Oct 16

+81

shannon

KeygraphHQ/shannon · ★ 49K

Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

+60

gitleaks

gitleaks/gitleaks · ★ 30K

Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

+21

nuclei

projectdiscovery/nuclei · ★ 32.1K

A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

+12

SafeLine

chaitin/SafeLine · ★ 22.8K

SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

The all-time top

16 projects · by stars

  1. #1 · KeygraphHQ/shannon

    shannon

    Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

    49K
  2. #2 · sqlmapproject/sqlmap

    sqlmap

    sqlmap is an open-source penetration testing tool that automates detecting and exploiting SQL injection flaws and taking over the underlying database server.

    38.7K
  3. #3 · OWASP/CheatSheetSeries

    CheatSheetSeries

    A collection of concise, high-value cheat sheets covering specific application security topics, maintained by OWASP.

    33.7K
  1. 4

    nuclei

    32.1Kprojectdiscovery/nuclei · Go

    A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

  2. 5

    gitleaks

    30Kgitleaks/gitleaks · Go

    Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

  3. 6

    SafeLine

    22.8Kchaitin/SafeLine · Go

    SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

  4. 7

    zaproxy

    16Kzaproxy/zaproxy · Java

    ZAP (Zed Attack Proxy) by Checkmarx is the world's most widely used web app security scanner, used to automatically find vulnerabilities in web applications during development and testing.

  5. 8

    dirsearch

    15Kmaurosoria/dirsearch · Python

    Dirsearch is an advanced command-line web path brute-forcer used to discover hidden files and directories on websites for security testing.

  6. 9

    juice-shop

    14.1Kjuice-shop/juice-shop · TypeScript

    OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

  7. 10

    awesome-web-security

    13.9Kqazbnm456/awesome-web-security · Python

    A curated list of web security materials and resources, organized by vulnerability class and attack type (XSS, SQL injection, CSRF, SSRF, XXE, deserialization, OAuth, JWT, and more), plus cheatsheets, tools, and write-ups for penetration testing.

  8. 11

    mastg

    13.3KOWASP/mastg · Python

    A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).

  9. 12

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

  10. 13

    Cybermes

    946Zyrexnn/Cybermes · Python

    Cybermes is an offensive security assistant and automation framework for authorized bug bounty hunting, reconnaissance, vulnerability research, and structured reporting, driven by AI agents and a library of 200+ playbooks.

  11. 14

    cve-lite-cli

    769OWASP/cve-lite-cli · TypeScript

    Most tools tell you what's wrong. CVE Lite CLI tells you what to run.

  12. 15

    VulnHunter

    735nealbridges/VulnHunter · Python

    An open-source, agentic AI security scanner that reasons like an attacker to find exploitable vulnerabilities in source code, proves them with executable proof-of-concept exploits, and fixes them test-first. It is a maintained fork of Capital One's VulnHunter, rebuilt to run on any agent harness instead of just Claude Code.

  13. 16

    Myrqen

    137stijnswapped/Myrqen · TypeScript

    Myrqen is a security testing tool that runs inside a coding agent (Claude Code, Codex, or OpenCode) you already use: its own static analysis engine finds vulnerability candidates in your TypeScript/JavaScript code, then the agent dynamically verifies them against the app running on your machine.

Often tagged together