CheatSheetSeries
owasp/cheatsheetseriesThe OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
code-analysisweb-securitycryptography+6
32.9k
Static and dynamic code analysis, SAST, DAST, and code review tools.
owasp/cheatsheetseriesThe OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
icsharpcode/ilspy.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
frida/fridaMain repo for hosting release binaries
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
facebook/inferA static analyzer for Java, C, C++, and Objective-C
projectdiscovery/nuclei-templatesCommunity curated list of templates for the nuclei engine to find security vulnerabilities.
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
google/magikaFast and accurate AI powered file content types detection
anthropics/defending-code-reference-harnessSkills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize
trailofbits/skillsTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
nvidia/skillspectorSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…
phpstan/phpstanPHP Static Analysis Tool - discover bugs in your code without running it!
vercel-labs/deepsecAgent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…
cure53/dompurifyDOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of…