#1API key scanning, credential leak detection, and secret management tools.
Kitploit recommended
byt3hx/jsleakConcurrent CLI tool for discovering secrets, API keys, and links in JavaScript files during web reconnaissance, with custom regex pattern support and…
bishopfox/dufflebagSearch exposed EBS volumes for secrets
manuelschipper/naha guard that blocks catastrophic agent actions
boostsecurityio/smokedmeatA CI/CD Red Team Framework for demonstrating Build Pipeline security risks.
cybertix-pvt-ltd/one-liner-collectionsThis Repositories contains list of One Liners with Descriptions and Installation requirements
watchdogsecurity/porch-piratePorch Pirate is the most comprehensive Postman recon / OSINT client and framework that facilitates the automated discovery and exploitation of API…
papermtn/slack-watchmanSlack enumeration and exposed secrets detection tool
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
undeadsec/swaggerspyAutomated OSINT tool that scans SwaggerHub API documentation to discover exposed secrets, credentials, and sensitive information using regex-based…
rderaison/bromureProper sandboxing for agentic coding and web browsing
synacktiv/nord-streamNord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports…
corgea/sighthoundTree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis for multi-language source code. Outputs findings as…
cynative/cynativeRead-only AI agent that queries your cloud, code, and runtime infrastructure to surface misconfigurations, leaked secrets, and privilege escalation…
bountystrike/bountystrike-shPoor (rich?) man's bug bounty pipeline https://dubell.io
ewenquim/entropyCLI tool that scans codebases for high-entropy lines to detect potential secrets, with customizable file extension and top-N filtering.
0sec-labs/foxguardA fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits,…
liamg/dismember:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.
rynosec/leakeyValidates leaked API tokens and keys using customizable JSON-based signature checks. Designed for pentesters and bug hunters to determine the impact…
