#security

A pre-commit hook for zizmor.

Multi-chain Rust wallet sdk, supports Bitcoin, Ethereum, Tron, Solana etc. https://cregisoffical.gitbook.io/anychain/

pure C# abstract syntax tree representation for parsing shell commands. Supports bash and PowerShell.

BonkLM - LLM Security Guardrails with Interactive Setup Wizard

The batteries-included TypeScript backend that goes serverless without leaving its batteries behind. Durable jobs + cron, multi-runtime (Node/Bun/Deno/Workers/Lambda/Vercel), built on Web Standard APIs. 1500+ tests.

A fast WordPress plugin enumeration tool

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.

PHP Captcha library

Auditable, token-gated DeepSeek Harness remote gateway: mobile QR access, per-device sessions, Host/Origin rewrite, settings/credentials/directory support.

MCP server for using the REMnux malware analysis toolkit via AI assistants

A Rust CLI and MCP server for X.509 certificate analysis, format conversion, and key verification. Reads certificates from PEM files or HTTPS endpoints. Validates TLS connections, checks revocation status, converts between PFX and PEM formats and integrates with AI-powered IDEs via the Model Context Protocol (MCP) and Vault.

ShieldCI Analyzers Core - Shared foundation for building static analysis tools. Includes abstract analyzer classes, result formatters, file parsers, and utilities. Used by both shieldci/laravel and shieldci/laravel-pro packages.

MPC Protocols for the Stoffel framework

Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.

Rapidly Search and Hunt through Windows Forensic Artefacts

Rapidly Search and Hunt through Windows Forensic Artefacts

Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

YASA-UAST is an intermediate representation structure for multi-language program analysis. The UAST-Parser parses code from different programming languages into a unified abstract syntax format.

Self-hosted browser fingerprinting and bot detection with real-world constraints in mind.

Local Python Sandbox

A linter for Dev Container definitions, Features, and Templates, with checks for correctness, security, and reproducibility.

occlusion for agent CLIs and APIs. Declare what an agent may run, and everything you did not name stays unreachable.

Classify raw untrusted URL strings by structural form: browser-vs-net/url parse quirks

The first TypeScript REST API framework built for secure AI-assisted services. DaloyJS combines runtime portability, contract-first OpenAPI, generated typed clients, zero-dependency runtime guardrails, and supply-chain-aware project defaults in one framework.

A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email

A Laravel security boundary for AI-triggered application actions. It bounds what an agent may do — authority, duplication, rate, approval — not what it was trying to do.

A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.

Fast, modern PHP request validation and sanitization. Schema-based rules, fail-fast execution, intelligent batching, and 100+ built-in validation rules.

A Vault/OpenBao plugin for Honeycomb API Secrets