#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
microsoft/applicationinspectorA source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…
owasp/devsecopsguidelineThe OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.
bearer/bearerCode security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
kadenzipfel/smart-contract-vulnerabilitiesA collection of smart contract vulnerabilities along with prevention methods
ajinabraham/nodejsscannodejsscan is a static security code scanner for Node.js applications.
wireghoul/grauditgrep rough audit - source code auditing tool
knostic/openantOpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws…
zegl/kube-scoreKubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your…
controlplaneio/kubesecSecurity risk analysis for Kubernetes resources
tencent/codeanalysisEnterprise-grade static code analysis platform with multi-language support, security vulnerability detection, code quality metrics, and DevOps…
python-security/pytA Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
behisecc/vibesec-skillThis skill helps Claude write secure code and prevent common vulnerabilities.
0xdea/semgrep-rulesA collection of my Semgrep rules to facilitate vulnerability research.
zupit/horusecHorusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
nealbridges/vulnhunterAgentic AI security scanner that reasons like an attacker over source code, confirms exploitable flaws with executable PoCs, and drives test-first…
stelligent/cfn_nagLinting tool for CloudFormation templates
pantheon-security/medusaAI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an…
