#security

SecScan is a fast, configurable secret scanning tool written in Go that detects API keys, tokens, credentials, and high-entropy secrets across source code and full Git history. Built for developers and CI pipelines, with strong defaults and low false positives.

Comprehensive defense-in-depth Magento 2 module that closes the PolyShell unrestricted file upload vulnerability (APSB25-94) — blocking polyglot webshell uploads across eight interception layers including request path blocking, controller-level upload prevention, polyglot file detection, and framework-level image hardening.

Cryptographic trust infrastructure for MCP servers — signed manifests, TOFU pinning, two-gate enforcement, and the "npm audit" scanner.

Deterministic cross-repo contract analysis you can gate CI on — joins frontend calls to backend routes across repo boundaries and flags drift (typo'd path, version skew, dead endpoint). Also a multi-language SAST/architecture engine (TS/JS, Prisma, Java), extensible via adapters. Rust core, npm CLI/SDK.

Browser-only privileged access management (PAM) for Linux fleets — SSH through a jump host with ephemeral SSH certificates, session recording, and tamper-evident audit.

phpMussel upload handler (dedicated Composer version).

Fast security-aware file tree walker — gitignore, binary detection, memmap2, parallel

Process sandbox for untrusted code - Linux namespaces, firejail, bubblewrap, watchdog timeout

Fast security-aware file tree walker — gitignore, binary detection, memmap2, parallel

A Go Client library for interacting with the Nessus vulnerability scanner API

An OSINT / digital forensics tool built in Python

IronSkillet is a set of day-one configuration templates for PAN-OS to enable alignment with security best practices. See the Quick Start section below to get started using the template configurations.

A rule based HTML sanitizer built on top of the HTML Agility pack

No repository description published.

Gain insight into any Linux command or application with no code modification

network time security client package for go

CLI toolkit for validating Kubernetes admission policies, Pod Security Admission labels, and cluster webhook safeguards.

An implementation of PyADRecon using ADWS instead of LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain. Evades EDR detections through ADWS.

🔒 Laravel validation rules that follow the password related recommendations found in NIST Special Publication 800-63B section 5.

The quality ratchet for TS/JS: 9 zero-config gates against a versioned baseline — quality can only improve, never regress.

A tool to generate an HTML report from pnpm audit.

Encrypted file transfer + reverse tunnel platform. SOCKS5 proxy, QUIC, Noise Protocol, MCP server, session persistence, HA clustering, PFS rekeying, per-tunnel ACLs, audit logging, traffic obfuscation. Single static binary.

Encrypted environment variable injection via a committed .kredsfile

Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.

Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health

Secure Templates is a tool to render templates using go-templates and load data values from secrets engine.

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Universal security audit skill for AI agents. 52 pure Markdown files encoding 15 years of pentest expertise — web & mobile security, OWASP-aligned, CVSS scoring, compliance checks, zero dependencies.

Shared governance engine for the opskit family of CLIs for AI agents — R0–R3 risk tiers, change-ticket & allow-flag authorization, RBAC, tamper-evident audit, credstore & redaction. Go library.

Security AI trainer/tuner and research toolkit. Fine-tune LLMs on MITRE ATT&CK-grounded data (QLoRA, GaLore, DeepSpeed, FP8, BitNet). 24K+ training pairs, 18 sources, 100% per-record provenance. Inversion-audit harness (Carlini 2021, 2022; MUSE 2024; LiRA). Terminal GUI for SSH use. 368+ tests.