All repos — GH Trending Explorer

Find secrets with Gitleaks 🔑

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Infisical / infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

prowler-cloud / prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

bytebase / bytebase

Database governance built for humans and agents — controlling changes and access across every major database.

gravitl / netmaker

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

openai / codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

bunkerity / bunkerweb

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

xonsh / xonsh

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

We5ter / Scanners-Box

The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵

firezone / firezone

Blazing-fast remote access

turbot / steampipe

Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.

lintsinghua / DeepAudit

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。

infobyte / faraday

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

hahwul / dalfox

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

jassics / security-study-plan

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

DefectDojo / django-DefectDojo

Open-Source Unified Vulnerability Management, DevSecOps & ASPM

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

ContainerSSH / ContainerSSH

ContainerSSH: Launch containers on demand

Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Checkmarx / kics

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

ajinabraham / nodejsscan

nodejsscan is a static security code scanner for Node.js applications.

google / mantis

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

betterleaks / betterleaks

Find leaked secrets everywhere.

m14r41 / PentestingEverything

GitGuardian / ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

ossf / cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

0xSteph / pentest-ai

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

project-copacetic / copacetic

🧵 CLI tool for directly patching container images!

mukul975 / cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

OWASP / wrongsecrets

Vulnerable app with examples showing how to not use secrets

owasp-noir / noir

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

aquasecurity / trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

owasp-dep-scan / dep-scan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

mongodb / kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

OWASP / DevSecOpsGuideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

safedep / vet

Protect against malicious open source packages 🤖

reconmap / reconmap

Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.

secureCodeBox / secureCodeBox

secureCodeBox (SCB) - continuous secure delivery out of the box

ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

Commando-X / vuln-bank

A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn pentesting and secure coding practices.

hashgraph-online / hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

Zyrexnn / Cybermes

Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.

asamassekou10 / ship-safe

The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.

duriantaco / skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

praetorian-inc / titus

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

devopsinsiders / azure-aws-gcp-devsecops-mlops-batch-18

Welcome to the official repository for Batch18! 📚👩‍💻 Here, you'll find a organized collection of class notes, assignments, and code snippets generated during our sessions.

nubenetes / awesome-kubernetes

A curated list of awesome references collected since 2018.

Privado-Inc / privado

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

chainloop-dev / chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

devsecopsmaturitymodel / DevSecOps-MaturityModel

—

safedep / pmg

PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.

boostsecurityio / poutine

poutine, a supply chain vulnerability scanner for build pipelines

turbot / powerpipe

Powerpipe: Dashboards for DevOps. Visualize cloud configurations. Assess security posture against a massive library of benchmarks. Build custom dashboards with code.

CrowdStrike / falconpy

The CrowdStrike Falcon SDK for Python

0sec-labs / 0

The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.

jassics / cybersecurity-roadmap

Skills and career roadmap for various security roles like application security, cloud security, DevSecOps, security engineer, security researchers, pentesting, api security, network security, mobile security and so on with helpful resources, guidelines