A lightweight shell & feature system for ASP.NET Core that lets you build modular and multi-tenant apps with per-shell DI containers and config-driven features.
Safe-by-default script sandbox in Go. Runs programs under default-deny OS isolation on Linux (bubblewrap + Landlock + seccomp): credential shielding, per-host network allowlisting via a host-side CONNECT proxy, resource limits, and a profile-then-grant consent flow. macOS support is planned.
Security-focused sandboxing core running apps via Podman containers or qemu VMs, each walled off from the rest of the desktop. Compositor-agnostic and installs cleanly on any existing system.
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node
Declarative @Transactional() for NestJS — TypeORM & Prisma. Keep @InjectRepository, drop the boilerplate. Built on @nestjs-cls/transactional, zero monkey-patching.