#devsecops

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

The Execution Security Layer for the Agentic Era. Providing deterministic "Sudo" governance and audit logs for autonomous AI agents.

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

Terraform provider for X API monitors, signed webhooks, profiles, followers & Twitter automation. Not affiliated with X Corp.

Find leaked secrets everywhere.

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.

Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.

Turn declarative exercises into reproducible, runnable and verifiable lab environments

JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Open-source Continuous Threat Exposure Management (CTEM) platform: asset discovery, attack surface management, risk-based prioritization, validation and remediation in one place. Go API + Next.js web UI.

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.

Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)

Enterprise AI Bootstrapping Harness

Local-first endpoint sensor for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.

Find secrets with Gitleaks 🔑

Efficiently show and monitor end-of-life dates for a number of products in your terminal and CI using endoflife.date API

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.

Compliance-as-Code framework that automatically enforces mostly all engineering standards.

Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.