aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

codesenberg / bombardier

Fast cross-platform HTTP benchmarking tool written in Go

zarf-dev / zarf

The Airgap Native Package Manager for Kubernetes

guacsec / guac

GUAC aggregates software security metadata into a high fidelity graph database.

chainloop-dev / chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.