Secret Detection

shieldfy/api-security-checklist

Checklist of the most important security countermeasures when designing, testing, and releasing your API

trufflesecurity/trufflehog

Find, verify, and analyze leaked credentials

infisical/infisical

Infisical is the open-source platform for secrets, certificates, and privileged access management.

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

gitleaks/gitleaks

Fast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…

getsops/sops

Simple and flexible tool for managing secrets

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

s0md3v/photon

Incredibly fast crawler designed for OSINT.

nvidia/skillspector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…

anchore/grype

A vulnerability scanner for container images and filesystems

vercel-labs/deepsec

Agent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…

streaak/keyhacks

Curated collection of commands to validate leaked API keys from bug bounty programs and penetration tests, covering 80+ services including AWS,…

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

bridgecrewio/checkov

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

snyk/cli

Snyk CLI scans and monitors your projects for security vulnerabilities.

ossf/scorecard

OpenSSF Scorecard - Security health metrics for Open Source