#1API key scanning, credential leak detection, and secret management tools.
Kitploit recommended
anshumanbh/kubebotA security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform
boringtools/git-alertsTool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
s0md3v/hardcodesfind hardcoded strings from source code
ustayready/golddiggerRecursively searches files for sensitive information using customizable regex patterns, designed for penetration testers to rapidly discover secrets…
blackfan/bfscanTool for finding URLs, paths, secrets and generating raw HTTP requests and OpenApi specifications from config files and annotations used in JAR / WAR…
traceforce/mcp-xrayUnified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…
santhreal/keyhogOpen-source secret scanner in Rust
m14r41/scan4secretsFind credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF,…
nuguardai/nuguardopensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis
syscallx-18113/apkx-hunterC-based Android static analysis framework for decompilation, secret detection, endpoint discovery, permission analysis, and native library scanning…
slowql/slowqlNext-generation SQL static analyzer written in Rust. 282+ rules. Zero false positives. Security, performance, reliability, cost, compliance, quality.…
papermtn/gitlab-watchmanFinding exposed secrets and personal data in GitLab
avito-tech/deepsecretsStatic analysis tool that scans source code for hardcoded secrets, API keys, and credentials using semantic understanding of code context.
zephrfish/azureattackkitCollection of Azure Tools to Pull down for Attacking an Environment + quick tips and other useful information
xaaha/hulakA lightweight, file-based CLI API client with age-encrypted secrets, first-class GraphQL support, and a built-in MCP server for AI agent workflows.
shubhamshubhankar/dumpthegitScans public GitHub repositories for accidentally uploaded sensitive data like credentials, secret keys, and tokens using a personal access token.
inceptionstack/lowkeyDeploy self-hosted AI coding agents (OpenClaw, Claude Code, Codex) into your AWS account with CloudFormation, IAM profiles, and sandbox isolation for…
mcp-shark/mcp-sharkWireshark-like forensic analysis for Model Context Protocol communications Capture, inspect, and investigate all HTTP requests and responses between…
