#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
garrytan/gstackUse Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
owasp/cheatsheetseriesThe OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
nationalsecurityagency/ghidraGhidra is a software reverse engineering (SRE) framework
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
radareorg/radare2UNIX-like reverse engineering framework and command-line toolset
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
icsharpcode/ilspy.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
analysis-tools-dev/static-analysisCurated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code…
frida/fridaMain repo for hosting release binaries
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
go-delve/delveSource-level debugger for Go with CLI, API, and headless modes; supports breakpoints, variable inspection, and execution tracing for efficient…
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
facebook/inferA static analyzer for Java, C, C++, and Objective-C
projectdiscovery/nuclei-templatesCommunity curated list of templates for the nuclei engine to find security vulnerabilities.
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
javascript-obfuscator/javascript-obfuscatorObfuscates JavaScript and Node.js code with variable renaming, string encryption, control flow flattening, and anti-debugging to protect source code…
github/codeqlCodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
