#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
joernio/joernOpen-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
nolabs-ai/nonoagent runtime security - zero trust, zero setup, zero latency agent sandboxing
semgrep/semgrep-rulesStatic analysis rule pack for detecting security vulnerabilities, dangerous code patterns, and configuration issues across many languages; integrates…
ezyang/htmlpurifierStandards compliant HTML filter written in PHP
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
c2sp/wycheproofProject Wycheproof tests crypto libraries against known attacks.
revng/revngOpen source binary analysis framework and decompiler built on LLVM and QEMU, lifting binaries to a readable intermediate representation for reverse…
microsoft/applicationinspectorA source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…
snyk/agent-scanSecurity scanner for AI agents, MCP servers and agent skills.
aquasecurity/tfsecTfsec is now part of Trivy
byt3bl33d3r/offensivenimMy experiments in weaponizing Nim (https://nim-lang.org/)
patriksimek/vm2Isolated JavaScript sandbox for Node.js that runs untrusted code with restricted access to built-in modules and host resources via Proxy-based…
dman95/sasmSASM - simple crossplatform IDE for NASM, MASM, GAS and FASM assembly languages
huhusmang/awesome-llms-for-vulnerability-detectionThe community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers…
yelp/detect-secretsAn enterprise friendly way of detecting and preventing secrets in code.
zinja-coder/jadx-ai-mcpPlugin for JADX to integrate MCP server
cisco-ai-defense/skill-scannerSecurity Scanner for Agent Skills
