#devsecops

Find, verify, and analyze leaked credentials

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

The CrowdStrike Falcon SDK for Python

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

secureCodeBox (SCB) - continuous secure delivery out of the box

Toolchain for the evaluation of different devsecops practices

Protect against malicious open source packages 🤖

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

Find and redact sensitive data before it leaks — a fast, offline CLI and Go library that detects PII, secrets, and credentials in files and streams, scores them with context-aware confidence, and redacts them format-preserving. Nothing leaves your host.

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. Hundreds of rules.

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

Open-Source Unified Vulnerability Management, DevSecOps & ASPM

Fail-closed execution firewall for AI agents: quarantine MCP tools, proxy OpenAI-compatible requests, emit signed receipts, and verify EvidencePacks offline.

Open-source AI agent framework for cloud security across AWS, Azure, GCP and Kubernetes: AI-powered cloud detection and response, and cloud security posture management findings triage.

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

Cross-platform developer workstation control plane powered by chezmoi — adaptive terminal themes, AI CLI workflows, read-only MCP, WASM attestations, encrypted secrets, and SLSA-verified releases.