Devsecops

CyberStrike is an open-source AI-powered offensive security agent that automates penetration testing by integrating with LLMs (Claude, GPT, etc.) to...

PentestingEverything is a comprehensive, searchable knowledge base for penetration testing and application security across 23 domains including web,...

This is a curated library of 817 structured cybersecurity skills mapped to six industry frameworks (MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND,...

Betterleaks is a configurable secrets scanner for detecting exposed credentials across Git repositories, cloud storage, and collaboration platforms....

Project Copacetic (copa) is a CLI tool for patching container image vulnerabilities directly without full image rebuilds, using vulnerability...

DeepAudit is an open-source multi-agent AI system for automated code vulnerability detection and auditing, designed for DevSecOps workflows. It...

CVE Binary Tool is a free, open-source security scanner that identifies known vulnerabilities in binaries and software components by matching against...

VET is a supply chain security tool that detects malicious open source packages through static and dynamic analysis, with policy-as-code enforcement...

Kingfisher is a high-performance secret detection and validation tool built in Rust, designed specifically for detecting leaked credentials, API...

Trivy is a comprehensive security scanner for finding vulnerabilities, misconfigurations, secrets, and software licenses across container images,...

Mobile Security Framework (MobSF) is a specialized automated platform for static and dynamic analysis of mobile applications across Android, iOS, and...

DefectDojo is a comprehensive DevSecOps and vulnerability management platform that orchestrates security testing, deduplication, remediation, and...

Dependency-Track is an OWASP-maintained Component Analysis platform that ingests Software Bill of Materials (SBOMs) to identify and mitigate supply...

ggshield is a specialized secrets detection CLI that scans for 500+ types of hardcoded credentials and API keys in code. It integrates into...

Firezone is an enterprise-grade zero-trust remote access platform built on WireGuard that provides peer-to-peer encrypted tunnels with fine-grained...

Trivy Action is a GitHub Actions wrapper for Aqua Security's Trivy vulnerability scanner, enabling automated container image and artifact scanning...

Gitleaks is a specialized secrets detection tool that scans Git repositories and files for exposed credentials like API keys, passwords, and tokens...

Bearer is an open-source static application security testing (SAST) tool that scans source code to identify security vulnerabilities and privacy...

TruffleHog is a specialized secrets detection and validation tool that discovers, classifies, and analyzes leaked credentials across 800+ secret...

Dalfox is a specialized XSS scanning and vulnerability testing tool written in Rust, designed for security professionals and bug bounty hunters who...

Prowler is an open-source cloud security platform that automates security and compliance auditing across AWS, Azure, and GCP environments. It is...

Bytebase is an open-source database DevOps platform that manages database schema changes through CI/CD pipelines, GitOps workflows, and collaborative...

Faraday is an open-source vulnerability management platform designed to centralize, aggregate, and normalize security scan data from multiple tools...

BunkerWeb is an open-source, cloud-native Web Application Firewall (WAF) built on NGINX that provides security-by-default protection for web...

A curated collection of open-source DevSecOps tools, methodologies, and resources organized by security stage (pre-commit, secrets, SAST, DAST,...

Netmaker automates the creation and management of WireGuard-based virtual networks, enabling mesh VPNs, site-to-site connectivity, and remote access...

Xonsh is a Python-powered shell that unifies shell scripting with Python syntax, enabling users to write cross-platform automation that seamlessly...

Scanners Box is a curated collection of 9,000+ open-source cybersecurity tools organized across 10+ categories, including AI-driven security agents,...

OWASP WrongSecrets is a deliberately vulnerable Java web application designed as a training tool for learning secrets management security. It...

Akto is an open-source API security platform that discovers APIs, maps security posture, and runs vulnerability tests with 1000+ built-in tests...