API-Security-Checklist
shieldfy/api-security-checklistChecklist of the most important security countermeasures when designing, testing, and releasing your API
authentication-authorizationweb-securitydevsecops+4
23.3k
API key scanning, credential leak detection, and secret management tools.
shieldfy/api-security-checklistChecklist of the most important security countermeasures when designing, testing, and releasing your API
hashicorp/vaultA tool for secrets management, encryption as a service, and privileged access management
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
infisical/infisicalInfisical is the open-source platform for secrets, certificates, and privileged access management.
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
getsops/sopsSimple and flexible tool for managing secrets
streaak/keyhacksCurated collection of commands to validate leaked API keys from bug bounty programs and penetration tests, covering 80+ services including AWS,…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
s0md3v/photonIncredibly fast crawler designed for OSINT.
projectdiscovery/nucleiNuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling…
nvidia/skillspectorSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…
vercel-labs/deepsecAgent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
google/osv-scannerVulnerability scanner written in Go which uses the data provided by https://osv.dev
devsecops/awesome-devsecopsAn authoritative list of awesome devsecops tools with the help from community experiments and contributions.
snyk/cliSnyk CLI scans and monitors your projects for security vulnerabilities.
ossf/scorecardOpenSSF Scorecard - Security health metrics for Open Source