#security

S3 auditor for codebases and AWS. Scans repos for S3 bucket/object references, compares against AWS, detects missing buckets, unused buckets, stale objects, and suspicious versioned files.

Actively maintained, security-hardened fork of Gophish — the open-source phishing toolkit

ASM2HEX 是一款功能强大的汇编语言与十六进制机器码相互转换工具。它提供了一个直观的图形界面,让用户可以轻松地在汇编指令和对应的机器码之间进行转换。无论你是处理 ARM64、ARM 还是 Thumb 指令集,ASM2HEX 都能提供准确可靠的转换结果。ASM2HEX is a powerful tool for bidirectional conversion between assembly language and hexadecimal machine code.

Firma digital en Facturación Electrónica

Generate OTP with expiry for PHP without using Database

A Vite plugin that injects Subresource Integrity (SRI) hashes into your build output.

Rust library for parsing and evaluating IAM policies. Provider-agnostic and designed for building flexible authorization systems.

Agent-safe sealed command execution — secrets injected behind airgap

Singul: Connect to your favorite services with a Singul line of code.

Cross-platform HttpClientHandler with TLS1.2 and Certificate Pinning

通用的Android inline hook库，支持thumb，arm32，arm64

A code ACL checker for Rust

🚀 Caido releases, wiki and roadmap

CLI + MCP server that audits what AI-generated code hides: security risks, algorithmic complexity, DB quality & code review.

Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.

Audit and fix your Mac's security in one command. No agent, no signup, open source.

GOSE = JOSE and friends for the Go developer

Security plugin for egg, force performance too.

Audit log plugin for Better Auth. Auto-captures auth events with severity inference, PII redaction, custom storage backends, and retention policies.

Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.

MCP server that gives LLM agents read-only shell access over SSH. Powers Fawdy (fawdy.com)

One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your machine.

Passkey / WebAuthn for the Milpa PHP framework — a verified assertion mints a session. Zero framework, zero ORM.

SDK and tools for Microsoft Foundry Voice Live API - real-time voice interactions with AI agents

Resolve secrets from KeePass, AWS, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, 1Password, macOS Keychain, and Windows Credential Manager into .env templates and subprocess environments.

A deterministic CLI that audits your GitHub enterprise, orgs, and repos against a security baseline you own — rules are data, the bar is per-target.

Library for quick product building using: Relational database (SQL Server, PostgreSql, MySql); NoSql database (MongoDb, Redis); Message Broker (RabbitMQ); Pipeline (Pipe and Filters pattern); Documentation (Swagger); Mapping (AutoMapper); Logging (NLog); Validation and specifications, unit of work, repository, among others.

Faraday middleware to prevent SSRF attacks

A Rust library for the Linux Landlock sandboxing feature

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist