npm · PyPI
bunkerity/bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
AGPL-3.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#web-security
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
27 records
Go · npm
fabriziosalmi/caddy-waf
Caddy WAF (Regex Rules, IP and DNS filtering, Rate Limiting, GeoIP, Tor, Anomaly Detection)
AGPL-3.0Sep 19, 2026 · metrics 2.10.0
Go
chaitin/SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
GPL-3.0Sep 19, 2026 · metrics 2.10.0
npm
rbonestell/vite-plugin-sri-gen
A Vite plugin to auto-generate Subresource Integrity (SRI) hashes.
MITOct 10, 2026 · metrics 2.10.0
RubyGems
0dayInc/pwn
PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.
MITSep 5, 2026 · metrics 2.10.0
npm
lissy93/domain-locker
🌐 The all-in-one tool, for keeping track of your domain name portfolio. Got domain names? Get Domain Locker!
MITSep 16, 2026 · metrics 2.10.0
Go
jub0bs/cors
perhaps the best CORS middleware library for Go
MITSep 11, 2026 · metrics 2.10.0
npm · Go · PyPI
WebDecoy/FCaptcha
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
MITSep 10, 2026 · metrics 2.10.0
npm
this-is-securl/securl
SecURL - passive external security posture scanner. Free hosted scanner, open-source engine, CI integration
MITSep 8, 2026 · metrics 2.10.0
Go
edoardottt/boggart
Highly customizable low-interaction experimental honeypot that mimics specific hosts.
GPL-3.0Sep 14, 2026 · metrics 2.10.0
npm
muneebs/csrf-armor
Modern, framework-agnostic CSRF protection library with multiple security strategies.
MITSep 15, 2026 · metrics 2.10.0
npm
ExorTek/nosql-sanitize
nosql-sanitize is a lightweight and blazing-fast suite of tools designed to prevent NoSQL Injection attacks in Node.js applications. It recursively sanitizes user-supplied data to remove characters and patterns (like $ and control characters) used in malicious MongoDB queries.
MITSep 15, 2026 · metrics 2.10.0
Go
cc1a2b/JShunter
jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.
MITSep 6, 2026 · metrics 2.10.0
npm · PyPI
glferreira-devsecops/Cascavel
🐍 Cascavel — The zero-friction offensive security engine. Automate Red Team scans, validate exposures (CTEM), and generate compliance reports in one command.
Custom licenseSep 19, 2026 · metrics 2.10.0
Go
sayseven7/frameseven
Offensive web security scanner — OWASP Top 10 · MCP server · CLI · Go
MITSep 17, 2026 · metrics 2.10.0
Maven · PyPI
devslab-kr/ssrf-guard
SSRF protection for the JVM — whitelist + private-IP filter + redirect re-validation + LLM-agent tool URL validation (Spring AI + LangChain4j). Modules for RestClient, RestTemplate, WebClient (reactor-netty DNS-time), Feign, Spring AI, LangChain4j, OkHttp, JDK HttpClient, Apache HttpClient 5. GraalVM native-image hints included.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Packagist
remotemerge/totp-php
Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration.
MITSep 19, 2026 · metrics 2.10.0
npm
7a6163/vite-plugin-sri4
A Vite plugin that injects Subresource Integrity (SRI) hashes into your build output.
MITOct 19, 2026 · metrics 2.10.0
crates.io
santhreal/wafrift
WAF evasion testing toolkit. Grammar + encoding mutation, dialect-specific bypasses, evolutionary search, per-WAF gene-bank persistence. Rust.
Apache-2.0Oct 4, 2026 · metrics 2.10.0
PyPI
Ge0rg3/requests-ip-rotator
A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.
GPL-3.0Sep 16, 2026 · metrics 2.10.0
npm
reclaimprotocol/tls
A TLS client implementation in typescript
No licenseOct 4, 2026 · metrics 2.10.0
PyPI
cyberark/QuicDrawH3
QuicDraw(H3) is A security research tool designed for fuzzing and racing HTTP/3 servers. QuicDraw implements the `Quic-Fin-Sync` on HTTP/3 (over QUIC) for race-condition testing.
Apache-2.0Oct 4, 2026 · metrics 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MITSep 22, 2026 · metrics 2.10.0
npm
3516634930/Payloader
渗透测试Payload速查平台 | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript
AGPL-3.0Sep 11, 2026 · metrics 2.10.0
npm
sandeep9526/securitywatch
Score-based runtime security middleware for Express with SQL injection, XSS, rate limiting, brute-force detection, suspicious behavior detection, payload anomaly detection, and IP reputation.
MITOct 5, 2026 · metrics 2.10.0
Go
CypherNova1337/paramvoid
Fast HTTP parameter discovery - finds the undocumented query and body parameters a server quietly accepts. Single static Go binary, bundled wordlist, no dependencies.
MITOct 13, 2026 · metrics 2.10.0
Go
hackthacker-sec/recontool
Unified reconnaissance CLI for subdomain discovery, HTTP probing, asset discovery, OSINT, and Wayback data combining subfinder, httpx, chaos, uncover, and Wayback CDX in one tool
MITSep 9, 2026 · metrics 2.10.0