Topics / #security-audit

Security-audit projects on GitHub

Auditing systems and code for security misconfigurations and risks.

As of , the most-starred Security-audit projects on GitHub are x64dbg (49.9K stars), shannon (49K stars) and security-audit-skill (30.4K stars). GitHub.Locker tracks 23 Security-audit repositories with 299.3K stars combined. The fastest-growing on October 16 was security-audit-skill, with +375 stars in a day.

23Projects
299.3KStars in total
+657Stars in a day
Browse in the catalog →github.com/topics/security-audit ↗

Hot right now

Most stars gained in a day · Oct 16

+375

security-audit-skill

cloudflare/security-audit-skill · ★ 30.4K

A Cloudflare coding-agent skill that turns your agent into a security auditor: it orchestrates isolated agents through a structured, multi-phase audit and returns independently verified, machine-readable findings.

+81

shannon

KeygraphHQ/shannon · ★ 49K

Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

+60

gitleaks

gitleaks/gitleaks · ★ 30K

Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

+33

inkloom

Inkloom-art/inkloom · ★ 1.8K

Inkloom builds specialised AI models that design logos as a sequence of explainable stages — brand analysis, typography, symbol construction and composition — rather than generating a single image.

The all-time top

23 projects · by stars

  1. #1 · x64dbg/x64dbg

    x64dbg

    x64dbg is an open-source user-mode debugger for Windows, built specifically for reverse engineering and malware analysis.

    49.9K
  2. #2 · KeygraphHQ/shannon

    shannon

    Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

    49K
  3. #3 · cloudflare/security-audit-skill

    security-audit-skill

    A Cloudflare coding-agent skill that turns your agent into a security auditor: it orchestrates isolated agents through a structured, multi-phase audit and returns independently verified, machine-readable findings.

    30.4K
  1. 4

    gitleaks

    30Kgitleaks/gitleaks · Go

    Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

  2. 5

    wazuh

    17.3Kwazuh/wazuh · C++

    Wazuh is a free, open source security platform (XDR and SIEM) for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads.

  3. 6

    lynis

    16.5KCISOfy/lynis · Shell

    Lynis is a security auditing and hardening tool for Linux, macOS, BSD, and other Unix-like systems. It scans the host it runs on for vulnerable software, misconfigurations, and weak settings, and gives hardening tips while also assisting with compliance testing (HIPAA, ISO27001, PCI DSS).

  4. 7

    prowler

    15Kprowler-cloud/prowler · Python

    Prowler is an open-source cloud security platform that automates security and compliance checks across AWS, Azure, GCP, Kubernetes, M365, GitHub, and many other providers.

  5. 8

    juice-shop

    14.1Kjuice-shop/juice-shop · TypeScript

    OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

  6. 9

    fluentd

    13.6Kfluent/fluentd · Ruby

    Fluentd is an open-source log collector that sits at the center of your logging setup: it gathers events from many data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and more.

  7. 10

    mastg

    13.3KOWASP/mastg · Python

    A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).

  8. 11

    vuls

    12.3Kfuture-architect/vuls · Go

    Vuls is an open-source, agent-less vulnerability scanner written in Go. It automatically detects vulnerabilities affecting your servers and can generate reports on a regular basis, for example via CRON.

  9. 12

    osv-scanner

    11.2Kgoogle/osv-scanner · Go

    OSV-Scanner is Google's open-source command-line vulnerability scanner: it checks your project's dependencies against OSV.dev, an open vulnerability database, and reports which known vulnerabilities affect you.

  10. 13

    the-practical-linux-hardening-guide

    10.9Ktrimstray/the-practical-linux-hardening-guide

    A free, practical guide to hardening GNU/Linux servers for production. It offers step-by-step instructions built on industry standards (CIS, STIG, NIST) and OpenSCAP baselines.

  11. 14

    skills

    7.6Ktrailofbits/skills · Python

    This is Trail of Bits' Claude Code plugin marketplace: a curated collection of AI-agent skills for security research, vulnerability detection, and audit workflows, covering everything from smart contract audits to malware analysis and reverse engineering.

  12. 15

    airgorah

    4.2Kmartin-olivier/airgorah · Rust

    Airgorah is a WiFi security auditing tool written in Rust that captures nearby WiFi traffic, discovers clients connected to access points, performs deauthentication attacks, captures handshakes and PMKIDs, and cracks access point passwords.

  13. 16

    inkloom

    1.8KInkloom-art/inkloom · TypeScript

    Inkloom builds specialised AI models that design logos as a sequence of explainable stages — brand analysis, typography, symbol construction and composition — rather than generating a single image.

  14. 17

    oss-scanner

    1Kanthropics/oss-scanner · Dockerfile

    OSS Scanner is a service run by Anthropic that scans enrolled open-source repositories for security vulnerabilities, building each project in an isolated VM and emailing the maintainer a reproducer plus a proposed patch for anything it finds.

  15. 18

    k8scout

    258k8scout/k8scout · Go

    k8scout is a single-binary tool you drop into a compromised Kubernetes pod to automatically map every realistic attack path from that foothold to cluster-admin, node escape, secret theft, or cloud IAM takeover.

  16. 19

    CVE-2026-62911

    187hypnguyen1209/CVE-2026-62911 · Python

    A proof-of-concept exploit for CVE-2026-62911, a pre-auth RCE in Microsoft Exchange Server that relays an NTLM machine account hash to the MRSProxy service to drop and run an ASPX webshell, giving full SYSTEM access without any credentials.

  17. 20

    clevis

    169nazarli-shabnam/clevis · JavaScript

    Clevis is a self-hosted dashboard that turns the GitHub API into security and analytics insight for your repositories and organizations — it computes a security score from six automated checks (MFA enforcement, branch protection, secret scanning, Dependabot alerts, code scanning alerts, default-branch force-push protection) and lets admins run privileged maintenance jobs like clearing GitHub Actions caches.

  18. 21

    audit-repo

    1571838904818/audit-repo · Python

    A Codex Skill for read-only, evidence-backed health audits of code repositories: it inventories tests, CI, dependencies, docs, security signals and technical debt, then turns verified findings into a prioritized action list. Standalone Python scripts for reproducible snapshots ship alongside it.

  19. 22

    Airsec

    150bas3line/Airsec · TypeScript

    Airsec is a CLI tool that drives a coding agent you already have installed (Claude Code, Codex, OpenCode, Command Code) through a structured, multi-pass security audit of your code, then turns the findings into an actionable report.

  20. 23

    GrantDecay

    128rojiloro/GrantDecay · Python

    GrantDecay is a CLI that compares what each principal was granted against what it actually used over an observation window, and reports unused permissions, narrowable roles, dormant principals, and ungranted use.

Often tagged together