wotschofsky / domain-digger
Full Toolkit for Next-Level Domain Analysis
wotschofsky / domain-digger
damienbod / angular-auth-oidc-client
npm package for OpenID Connect, OAuth Code Flow with PKCE, Refresh tokens, Implicit Flow
reversenseorg / dexcalibur
Reversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur. Reversense is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications.
APTRS / APTRS
Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!
melandlabs / openloomi
OpenLoomi is an open-source AI coworker. It connects your work tools, understands what youβre working on, and tells you what needs your attention, why it matters, and what to do next. Itβs your open-source Attention Agent.
reconmap / reconmap
Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling endβtoβend engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AIβassisted summaries, it delivers faster, more structured, and highβquality security assessments.
jdevalk / specification.website
Website specification β HTML, accessibility, security, SEO, agent-readiness. Platform-agnostic, sourced, MIT.
agsh / onvif
ONVIF client for all ONVIF devices with TypeScript types. Supports Profiles S/T/G/M/C/A, WS-Discovery, WS-Security/Digest, Events, Media/Media2, PTZ, Recording/Replay, and a 0.x compatibility layer.
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
RevokeCash / revoke.cash
β Revoke or update your token approvals
sgasser / pasteguard
AI gets the context. Not your private data. Local-first privacy proxy for browser chat, AI APIs, and coding agents.
ZeroLeaks / zeroleaks
AI Security Scanner - Test your AI systems for prompt injection and extraction vulnerabilities
arcjet / arcjet-js
Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.
decionis / agent-safe-pipeline
An execution-authority gateway for AI agents and APIs. It intercepts consequential HTTP actions, asks Decionis whether they are authorized, and forwards exactly the authorized request once on a single-use grant, holds it for a person, or refuses it, leaving chained evidence of each. Installs by Homebrew, Linux package, Docker or Helm.
AxaFrance / oidc-client
Light, Secure, Pure Javascript OIDC (Open ID Connect) Client. We provide also a REACT wrapper (compatible NextJS, etc.).
yyhuni / xingrin
Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.
azat-io / actions-up
π Interactive CLI tool to update GitHub Actions to latest versions with SHA pinning
google / webauthndemo
An example Node.js Relying Party implementation of the WebAuthn specification
provos / ironcurtain
A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)
emiliaprotocol / emilia-protocol
Authority control plane for autonomous work. EMILIA Gate enforces finite customer-owned mandates at protected executor boundaries; the open protocol keeps evidence verifiable.
kkomelin / isomorphic-dompurify
Use DOMPurify on server and client in the same way
ChiChou / vscode-frida
Unofficial frida extension for VSCode
utmstack / UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
Escape-Technologies / graphql-armor
π‘οΈ The missing GraphQL security security layer for Apollo GraphQL and Yoga / Envelop servers π‘οΈ
kac89 / vulnrepo
VULNRΞPO - Free vulnerability report generator and repository, end-to-end encrypted! Templates of issues, CWE,CVE,MITRE ATT&CK,PCI DSS, import Nmap/Nessus/Burp/OpenVAS/Bugcrowd/Trivy, Jira export, TXT/JSON/MARKDOWN/HTML/DOCX, attachments, automatic changelog, stats, vulnerability management, bugbounty, local ai/llm, super fast pentest reporting!
KeyValueSoftwareSystems / agent-opfor
Open-source adversary emulation for AI agents and MCP servers.
superwerker / superwerker
superwerker can help you get started with the AWS Cloud quickly without investing in consultants or devoting time to extensive research. superwerker is a free, open-source solution that lets you quickly set up an AWS Cloud environment following best practices for security and efficiency so you can focus on your core business.
Levminer / authme
Simple cross-platform two-factor (2FA) authenticator app for desktop.
okasi / bot-signal
TypeScript bot detection: catch WebDriver, headless Chrome, Playwright/Puppeteer, robotic mouse/typing, datacenter IPs, JA3 TLS mismatch & timezone spoofing β browser + Node.
LifetimeLabsDev / PrivacyNotes.app
End-to-end encrypted notes, tasks, files, passwords, journal and bookmarks. Keyed by a 12-word BIP-39 phrase: no email, no password, no account to leak. The full client source for web, desktop and mobile is published, along with the encryption (XChaCha20-Poly1305, HKDF-SHA256, Ed25519) and the threat model, so the privacy claims are falsifiable.
cilium / hubble-ui
Observability & Troubleshooting for Kubernetes Services
wazuh / wazuh-dashboard-plugins
Plugins for Wazuh Dashboard
turbot / powerpipe
Powerpipe: Dashboards for DevOps. Visualize cloud configurations. Assess security posture against a massive library of benchmarks. Build custom dashboards with code.
0sec-labs / 0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
TheLunarCompany / lunar
lunar.dev: Agent native MCP Gateway for governance and security
panva / paseto
PASETO (Platform-Agnostic SEcurity TOkens) for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes
S1N6H / pentest-harness
Pentest Harness β Heaven for Hackers. A self-hosted AI agent harness for authorized pentests, bug bounty, security labs, and CTFs. Bring your own AI model API; sessions stay local.
dodoguardai / dodoguard
DodoGuard: Take AI Agents to Production. Test, validate, and operate AI Agents before and after deployment.for Dify, Coze, FastGPT, n8n, Tencent ADP, ByteDance HiAgent, and more.
bas3line / Airsec
Find Security Issues in your code by using coding CLIs like Claude, Codex & CommandCode
stijnswapped / Myrqen
Security testing that runs inside the coding agent you already use. Source-available, not open source.
adnxy / react-native-secure-webview
Secure WebView for React Native auth, checkout, OAuth, and other controlled web flows.
Ch1nfo / RiftX
Pentest anything you want
vuphongle / oss-pr-reviewer
AI-powered CLI for reviewing GitHub pull requests, detecting potential bugs, security risks, regressions, and missing tests, with structured Markdown reports for open-source maintainers.
mrtinkz / ai-charter
Universal AI Charter: plain-language governance principles and a public certification registry for AI models, built on disclosure instead of a development slowdown.
jiangkoumo / toolfence
Local, fail-closed policy enforcement and human approval for MCP tool calls.
backenly / backenly
Autonomous backend platform. Your coding agent builds it over MCP, Backenly keeps it running: Postgres, REST APIs, auth, storage, realtime, and functions, with every change governed, verified, and reversible.
seyimusibau-cyber / hardenerAi
Hardener Plus is an advanced security auditing platform for modern web architectures. It employs dynamic profiling and deep heuristics to detect complex vulnerabilities, logical bypasses, and injection points that basic scanners miss. It also provides URL pulse checks, automated patching, and CI/CD integration.
typesafe-docs / origin-scoped-fetch
A fetch wrapper that drops your custom auth headers when a redirect crosses to another origin.
typesafe-docs / action-dist-verify
Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.
ahmetgulerpy / ag-cyber-lab
Open-source practical cybersecurity learning platform with structured lessons, guided labs, progress tracking, and a custom Lab Engine.
Hamidooh / securify
High-speed web security auditor & DevSecOps dashboard for SSL, HTTP headers, DNS defenses, and port exposure.
flankerhqd / cyvisguard
Security control plane for AI agents β identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
diyanbogdanov / emend
Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compiles and passes your tests.
AnonymousNomad / covert-coder
Covert Coder β a local-first sovereign AI development environment for governed models, workflows, execution, evidence, and verification.
agentscope-ai-java / json-guard
JSON.parse with hard limits on nesting depth, key count, string length and input size. Refuses parser bombs before they are allocated.
JUANWANG-BUAA / dsh-full-remote
Auditable, token-gated DeepSeek Harness remote gateway: mobile QR access, per-device sessions, Host/Origin rewrite, settings/credentials/directory support.
Mister-iks / pcybox-attackgraph
Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.
divinelabio / Aegis
Next-Gen Selfhosted Web Application Firewall (WAF) & Edge Reverse Proxy built in Go. Real-time threat defense, L7 traffic control, and unified admin console.
tsale / jevline
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
Perruer / keelflow
Build AI agents and LLM workflows visually. Security-maintained continuation of Flowise: security fixes, Apache-2.0 only, drop-in for your existing flows and data.