chaitin / SafeLine

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

pipelab-org / pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

safing / portmaster

🏔 Love Freedom - ❌ Block Mass Surveillance

crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

Velocidex / velociraptor

Digging Deeper....

maxlerebourg / crowdsec-bouncer-traefik-plugin

Traefik plugin for Crowdsec - WAF and IP protection

kanisterio / kanister

An extensible framework for application-level data management on Kubernetes, Kanister is a Cloud Native Computing Foundation sandbox project and was originally created by the Veeam Kasten team.

bytedance / vArmor

vArmor is a cloud-native container hardening system that leverages AppArmor/BPF/Seccomp and NetworkProxy technologies to enforce access control from system calls to application protocols — protecting workloads including AI Agents.

projectcalico / calico

Cloud native networking and network security

rabbitstack / fibratus

Security sensor for realtime threat detection and protection

mkubaczyk / helmsman

Helm Charts as Code

safedep / vet

Protect against malicious open source packages 🤖

backube / volsync

Asynchronous data replication for Kubernetes volumes

AdguardTeam / AdGuardDNS

Public DNS resolver that protects you from ad trackers

pika-monitor / pika

Lightweight probe monitoring — Go + VictoriaMetrics + PostgreSQL/SQLite | Real-time metrics, service checks, tamper protection & security audit

safedep / pmg

PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.

Calcium-Ion / AstrLink

A local AI gateway for AI agents, unifying your subscriptions and API providers with smart routing and on-device privacy protection.

hashcott / ghostline

One-click encrypted DNS (DoH/DoT/DoQ/DNSCrypt), protection against DPI interference with zapret2 (or GoodbyeDPI on Windows), a local HTTP/SOCKS proxy with TLS fragmentation, and domain rules for Windows and Linux. ~30 MB RAM, no telemetry, always restores your original DNS. For privacy, security research and education.

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.