#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
owasp/wpbulletStatic code analysis scanner for WordPress plugins and themes. Detects vulnerabilities like XSS and SQL injection via modular, extensible…
nccgroup/ncccodenaviNCC Code Navigator
blackvectorops/semantic_firewallGenerate deterministic semantic fingerprints for Go functions. Detect xz-style backdoors and verify semantic equivalence using Static Single…
owasp/secure-coding-practices-quick-reference-guideThe Secure Coding Practices Quick-reference Guide from OWASP
mustafabilgici/sucoshscanny"Sucosh" is an automated Source Code vulnerability scanner and assessment framework for Python(Flask-Django) & NodeJs capable of performing code…
vigiloss/vigilAI harness for long-running code audits, web pentests, and bug bounty hunting, built around how real investigations fail: anchored hypotheses, false…
0x3c3e/slidesCodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU
0p4n1k/noctyraAST-based Python code transformation & deobfuscation framework
osmankandemir/static-code-analysis-helperScans project source code across 16 languages to flag dangerous functions linked to SQLi, XSS, SSRF, command injection, weak crypto, and other web…
nccgroup/call_mapCurrent development for Call Map takes place at https://github.com/ajylee/call_map. Call Map is a tool for navigating Python call graphs.
nccgroup/glasgoGo static analysis tool that checks for security issues using an AST.
owasp/abap-code-scannerABAP Code Analyzer
synacktiv/weggli_rules_sstic2023Curated weggli queries for static analysis of C/C++ code to identify dangerous functions, stack issues, and malloc overflow vulnerabilities.
nightwatchcybersecurity/airflowscanChecklist and tools for increasing security of Apache Airflow
nationwide-group-oss/cryptopticCodeQL-based scanner that inventories cryptographic function calls across repositories and GitHub organizations, producing a Cryptographic Bill of…
zappaboy/vuln-scannerVulnerability Assessment Scanner with Report Generation
synacktiv/appledb_rsCurated database of Apple internal artifacts (entitlements, frameworks, device versions) with API, CLI, and WebUI for iOS/macOS security research and…
bekk/retire.jsretire.js has a new home
