#1API key scanning, credential leak detection, and secret management tools.
Kitploit recommended
edoardottt/cariddiTake a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
owasp/cve-lite-cliFast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix,…
cisco-ai-defense/skill-scannerSecurity Scanner for Agent Skills
moltis-org/moltisA secure persistent personal agent server in Rust. One binary, sandboxed execution, multi-provider LLMs, voice, memory, Telegram, WhatsApp, Discord,…
onecli/onecliOpen-source sandboxed agent harness for teams. Giving every employee a secured personal agent.
sheeki03/tirithTerminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and…
zizmorcore/zizmorStatic analysis tool for CI/CD systems that detects and fixes security issues in GitHub Actions, Dependabot, and pre-commit configurations, including…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
gitguardian/ggshieldDetect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret…
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
aquasecurity/trivy-actionRuns Trivy as GitHub action to scan your Docker container image for vulnerabilities
prismorsec/prismorSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…
google/osv-scannerVulnerability scanner written in Go which uses the data provided by https://osv.dev
promptfoo/modelauditSecurity scanner for AI/ML model files. Detects malicious code, backdoors, and vulnerabilities before deployment
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
ag3ntsc4rn/autorun-auditFind code that runs without you asking: repo files that execute on folder open (VS Code tasks, agent hooks, MCP, devcontainers) and Python…
owasp/wrongsecretsVulnerable app with examples showing how to not use secrets
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
