RikkaApps / Shizuku

Using system APIs directly with adb/root privileges from normal apps through a Java process started with app_process.

Infisical / infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

thejaustin / ShizukuPlus

Shizuku+ brings Root/ADB/Dhizuku unification, a Plus API suite, OneUI/Android 16+ support, M3E theming, TCP connectivity, improved customization, & more.

containers / bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

jumpserver / jumpserver

JumpServer is an Open-source Privileged Access Management (PAM) platform with AI-powered capabilities, providing DevOps and IT teams a unified workspace to securely access SSH, RDP, Kubernetes, databases, websites, RemoteApp, VirtualApp, and more.

warp-tech / warpgate

Fully transparent SSH, HTTPS, Kubernetes, database and RDP/VNC bastion/PAM that doesn't need additional client-side software

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management

next-terminal / next-terminal

A simple, secure, easy-to-use bastion and session auditing system. Supports RDP, SSH, VNC, Telnet, HTTP, records and replays sessions for auditing and compliance.

qianyumeng0228 / ShizukuX

ShizukuX 是 Shizuku 的增强分支：让普通应用借助 ADB / Root 特权进程直接调用系统级 API，并内置 Dhizuku、Extra API、Root 兼容桥等高级能力。继承自 ShizukuPlus（Apache 2.0）。

Zouuup / landrun

Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.

cr1437 / Shizako

猫耳看板娘的系统权限助手：不 Root 也能用特权 API，兼容 Shizuku-API 生态（官方 SDK 应用零改动直连）| A catgirl-mascot privileged-API assistant for Android. Shizuku-API compatible — apps built on the official SDK connect unchanged. Apache-2.0

basecamp / hotcell

☢️HotCell☢️ is an unprivileged sidecar container for handling untrusted inputs, purpose-built for Rails applications.

riscv / riscv-isa-manual

RISC-V Instruction Set Manual

rootless-containers / slirp4netns

User-mode networking for unprivileged network namespaces

Supersonic / TLPE

CVE-2026-49881, using insecure context creation in Android 17's Telecom service to execute arbitrary code as UID 1000 system_server from an unprivileged app

NVIDIA / enroot

A simple yet powerful tool to turn traditional container/OS images into unprivileged sandboxes.

CompassSecurity / EntraFalcon

A lightweight PowerShell tool for assessing the security posture of Microsoft Entra ID environments. It helps identify privileged objects, risky assignments, and potential misconfigurations.

aramosf / CVE-2026-64468

Linux Binder binder_free_transaction() process-lifetime use-after-free (CVE-2026-64468): unprivileged PoC + x86_64 LPE. Authorised security research.

e-fin / PsPipeExec.py

Novel lateral movement and privilege escalation tool leveraging PowerShell named pipes. Allows for executing PowerShell commands over the network using named pipes, and taking over highly privileged users PowerShell named pipes.

reindertpelsma / kayfabe

The GPU your VM believes in. A stock NVIDIA driver runs against fabricated hardware; real compute is forwarded to a host GPU. Hypervisor-agnostic, multi-tenant, unprivileged per-process isolates. Rust.

Kron4ek / Conty

Easy to use unprivileged Linux container packed into a single portable executable