#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
offensive360/sast-scan-actionGitHub Action: Offensive360 SAST scan with SARIF output for code scanning. 60+ languages. Free for open source.
offensive360/mcp-serverMCP server that runs SAST scans on local codebases and returns findings with severity and fixes, enabling AI assistants to perform security analysis…
arian-gogani/enforcement-coverageFinds API routes carrying weaker authorization than their siblings. Recovered CVE-2026-45316 from source. Includes the negative results.
awarexone/agentic-bug-hunterAI-powered bug bounty hunting toolkit that works with or without subscription.
splx-ai/agentic-radarA security scanner for your LLM agentic workflows
stelligent/cfn_nagLinting tool for CloudFormation templates
osmankandemir/static-code-analysis-helperScans project source code across 16 languages to flag dangerous functions linked to SQLi, XSS, SSRF, command injection, weak crypto, and other web…
contrastsecurity/contrastSAST CLI for scanning Java, JavaScript, and .NET applications plus AWS Lambda functions, detecting code vulnerabilities and over-permissive IAM…
analysis-tools-dev/static-analysisCurated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code…
controlplaneio/kubesecSecurity risk analysis for Kubernetes resources
semgrep/semgrep-rulesStatic analysis rule pack for detecting security vulnerabilities, dangerous code patterns, and configuration issues across many languages; integrates…
promptfoo/modelauditSecurity scanner for AI/ML model files. Detects malicious code, backdoors, and vulnerabilities before deployment
sonarsource/sonarqubeCode-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…
stackrox/kube-linterKubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…
rakib-nyc/nulloriginResearch-only AI watermark robustness toolkit: local reverse proxy strips C2PA/EXIF/XMP, Unicode, image/audio stego, OOXML/PDF metadata, and scans…
limingxi6/cve-2020-9373-netgear-r6400解决网络安全漏洞
github/codeqlCodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
gmh5225/actions-secretsAdding this GitHub Action will scan your repository for sensitive data in your source code. We find things like passwords, server host strings, API…
