#security

Deterministic cross-repo contract analysis you can gate CI on — joins frontend calls to backend routes across repo boundaries and flags drift (typo'd path, version skew, dead endpoint). Also a multi-language SAST/architecture engine (TS/JS, Prisma, Java), extensible via adapters. Rust core, npm CLI/SDK.

The quality ratchet for TS/JS: 9 zero-config gates against a versioned baseline — quality can only improve, never regress.

Passlib fork

Encrypted environment variable injection via a committed .kredsfile

Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.

Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health

IronSkillet is a set of day-one configuration templates for PAN-OS to enable alignment with security best practices. See the Quick Start section below to get started using the template configurations.

Gain insight into any Linux command or application with no code modification

Go client library for the Vulners vulnerability database API — search, audit, SBOM, VScanner, and more

Safe archive-reader for ZIP-derived formats (ZIP, CRX, JAR, APK, IPA) with BOM-safe checks.

Safe archive-reader for ZIP-derived formats (ZIP, CRX, JAR, APK, IPA) with BOM-safe checks.

Secrets that refuse to be stolen. Sealed API keys that decrypt only on your allowlisted repo — and raise a security error if anything tries to print, iterate, or read them. Every access attempt alerts the owner.

Collection of ssl verification functions for Erlang

[READ ONLY] A generic interface to implement two-factor authentication in Symfony applications

A universal security-by-default framework for Model Context Protocol (MCP) servers that provides multi-layered defense against traditional attacks.

MCP server — read-only log access for AI assistants. Debug your Linux server with AI, without giving the AI shell access.

MCP governance proxy - zero-dependency single binary (Go)

Your AI remembers what it did, proves it, and gets smarter every session

Sensitive is a middleware for GoFiber to blind sensitive value like mobile no, citizen id, etc. by defined configuration. Useful for security policies.

A PHP SVG/XML Sanitizer

Recon tool for pentesters & bug bounty hunters: check robots.txt, security.txt (RFC 9116) and /.well-known/ across many targets. CLI + web UI, single static Go binary.

NSAuditor AI — Open-source, AI-powered network security scanner. 27 plugins, CVE matching, MITRE ATT&CK mapping, verified vulnerabilities, continuous monitoring, MCP integration. Zero data exfiltration. MIT licensed.

Automatic redaction of sensitive data for safe logging and debugging

Build a complete authentication system in NestJS — without Firebase or Auth0. nestjs-multi-auth is a self-hosted identity provider that handles: JWT + refresh tokens OAuth (Google, Facebook, Apple) Magic links (passwordless login) MFA / 2FA (TOTP) Account linking (multiple login methods per user)

Secure Templates is a tool to render templates using go-templates and load data values from secrets engine.

No repository description published.

efficiently parse values

Security linter for a-h/templ: detects XSS-prone htmx / Alpine.js usage by parsing .templ files directly with parser/v2

Sensitive is a middleware for GoFiber to blind sensitive value like mobile no, citizen id, etc. by defined configuration. Useful for security policies.

HTTP security headers for Flask