Topics / #security-scanner

Security-scanner projects on GitHub

Scanners that detect vulnerabilities and misconfigurations in systems and web applications.

As of , the most-starred Security-scanner projects on GitHub are nuclei (32.1K stars), gitleaks (30.1K stars) and SkillSpector (20.5K stars). GitHub.Locker tracks 11 Security-scanner repositories with 152.3K stars combined. The fastest-growing on October 18 was SkillSpector, with +72 stars in a day.

11Projects
152.3KStars in total
+140Stars in a day
Browse in the catalog →github.com/topics/security-scanner ↗

Hot right now

Most stars gained in a day · Oct 18

+72

SkillSpector

NVIDIA/SkillSpector · ★ 20.5K

SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

+24

gitleaks

gitleaks/gitleaks · ★ 30.1K

Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

+22

nuclei

projectdiscovery/nuclei · ★ 32.1K

A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

+8

zaproxy

zaproxy/zaproxy · ★ 16K

ZAP (Zed Attack Proxy) by Checkmarx is the world's most widely used web app security scanner, used to automatically find vulnerabilities in web applications during development and testing.

The all-time top

11 projects · by stars

  1. #1 · projectdiscovery/nuclei

    nuclei

    A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

    32.1K
  2. #2 · gitleaks/gitleaks

    gitleaks

    Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

    30.1K
  3. #3 · NVIDIA/SkillSpector

    SkillSpector

    SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

    20.5K
  1. 4

    lynis

    16.5KCISOfy/lynis · Shell

    Lynis is a security auditing and hardening tool for Linux, macOS, BSD, and other Unix-like systems. It scans the host it runs on for vulnerable software, misconfigurations, and weak settings, and gives hardening tips while also assisting with compliance testing (HIPAA, ISO27001, PCI DSS).

  2. 5

    zaproxy

    16Kzaproxy/zaproxy · Java

    ZAP (Zed Attack Proxy) by Checkmarx is the world's most widely used web app security scanner, used to automatically find vulnerabilities in web applications during development and testing.

  3. 6

    vuls

    12.3Kfuture-architect/vuls · Go

    Vuls is an open-source, agent-less vulnerability scanner written in Go. It automatically detects vulnerabilities affecting your servers and can generate reports on a regular basis, for example via CRON.

  4. 7

    xray

    11.8Kchaitin/xray · Vue

    xray is a security assessment tool built by Chaitin for scanning common web vulnerabilities and running custom PoCs against targets.

  5. 8

    DeepAudit

    7.2Klintsinghua/DeepAudit · Python

    DeepAudit is a multi-agent AI platform for code security auditing. It mimics how a security expert thinks, using cooperating agents (Orchestrator, Recon, Analysis, Verification) to find vulnerabilities and then verify them with automated sandbox PoC exploitation.

  6. 9

    codeflow

    5.4Kbraedonsaunders/codeflow · HTML

    CodeFlow turns any GitHub repository (or local folder) into an interactive architecture map: a dependency graph showing how files connect, plus security, pattern, and code-health analysis.

  7. 10

    bashka

    243dmtrKovalenko/bashka · Rust

    bashka is a drop-in safety guard for the curl | bash install pattern: it parses the incoming install script, scores it against many checks, and follows forwarded scripts so every layer gets analyzed.

  8. 11

    geiger

    167Atomburstofficial/geiger · JavaScript

    Geiger is a read-only scanner for AI tooling: one command inventories every AI agent, harness, MCP server, plugin and AI extension on a machine and says in plain language what each one can touch.

Often tagged together