gitleaks / gitleaks

Scans git repos, files, and stdin for hardcoded secrets such as passwords, API keys, and tokens.

trhhubsd / ARTEX

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

Autumn-27 / ScopeSentry

Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.

Ernket / CodeScan-Artex

二开artex的代码审计平台 | 新增本地反编译java依赖库 | 多账号管理

projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

trufflesecurity / trufflehog

Scans repositories, filesystems, and chats for leaked credentials, then verifies whether each one is still live.

anchore / grype

A vulnerability scanner for container images and filesystems

shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

pipelab-org / pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

PatchMon / PatchMon

Linux Patch Management & Automation Platform

goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

betterleaks / betterleaks

Find leaked secrets everywhere.

projectdiscovery / naabu

A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests

291-Group / LAN-Orangutan

LAN-Orangutan is a self-hosted network discovery tool. Find every device on your LAN, label and group them, snapshot your network and compare it later, and get flagged when something unexpected shows up. Single binary, no setup, Tailscale built in. Built by 291 Group.

future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

dwisiswant0 / crlfuzz

A fast tool to scan CRLF vulnerability written in Go

vigolium / vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

raskrebs / sonar

CLI tool for inspecting and managing services listening on localhost ports

projectdiscovery / urlfinder

A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.

praetorian-inc / titus

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

boostsecurityio / poutine

poutine, a supply chain vulnerability scanner for build pipelines

claudiodangelis / qrcp

:zap: Transfer files over wifi from your computer to your mobile device by scanning a QR code without leaving the terminal.

perplexityai / bumblebee

Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.

zan8in / afrog

A Security Tool for Bug Bounty, Pentest and Red Teaming.

5rahim / seanime

Open-source media server with a web interface and desktop app for anime and manga.

ibnaleem / gosearch

🔍 Search anyone's digital footprint across 300+ websites

edoardottt / cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

google / osv.dev

Open source vulnerability DB and triage service.

Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

MatinSenPai / SenPaiScanner

A light-weight scanner for Cloudflare IPs, written in Golang

ramonvermeulen / whosthere

Local Area Network discovery tool with an interactive Terminal User Interface (TUI) written in Go. Discover, explore, and understand your LAN in an intuitive way. Knock Knock.. who's there? 🚪

zmap / zgrab2

Fast Application Layer Scanner

aquasecurity / trivy-operator

Kubernetes-native security toolkit

cr0hn / dockerscan

The Most Comprehensive Docker Security Scanner

ZupIT / horusec

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

edoardottt / scilla

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

xalgorix / xalgorix

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

zmap / zdns

Fast DNS Lookup Library and CLI Tool

madneal / gshark

Scan for sensitive information easily and effectively.

chushuai / wscan

Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.

eraser-dev / eraser

🧹 Cleaning up images from Kubernetes nodes

blockloop / scan

Tiny lib to scan SQL rows directly to structs, slices, and primitive types

vmfunc / sif

the blazing-fast pentesting suite.

akha-security / akca

AKCA Advanced Web Security Scanner

rootdr-backup / Reconner

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

MatinSenPai / Gemini-Config-Checker

Chain region scanner: find proxy configs that get you into Google AI Studio and Gemini (signed-in browser check, anti-DPI, Windows/macOS/Linux/Android)

KaiZhou554 / trayce

Trayce — A lightweight, no-admin Windows 11 utility to view and clean up stale notification area (tray) icon records in your user registry. Built with Wails v2, Vue 3, and Naive UI. Offline-first: scans HKCU\Control Panel\NotifyIconSettings, auto-backs up before deletion, supports undo, and never touches HKLM or your files.

DavidCarliez / cover

Keep private data, internal infrastructure and secrets out of cloud coding agents without breaking your workflow.

liyanan2016-stack / guanfang-youxuan

官方优选 - Cloudflare 官方 IP 段优选工具，Android + Windows/Linux

yyhuni / lunafox

Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerability management.

runZeroInc / oobscan

Out-of-band management device scanner

Spade-sec / jsowl

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交互式 HTML 报告，是渗透测试、红队信息收集与 Web 安全测试的高效自动化方案。