#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
contrastsecurity/contrastSAST CLI for scanning Java, JavaScript, and .NET applications plus AWS Lambda functions, detecting code vulnerabilities and over-permissive IAM…
tai-e/cve-2021-44228Utilize Tai-e to identify the Log4shell (a.k.a. CVE-2021-44228) Vulnerability
martyx00/vulnfanatic-ngBianryNinja plugin for identifying vulnerabilities in decompiled binaries with both programmatic scans and LLM support.
nccgroup/lightweight_static_analysisCreate useful, lightweight static analyses using open source tools + a tiny bit of your code
synacktiv/action-octoscan📦 :octocat: A GitHub Action that performs a security scan of your GitHub Actions.
openbreach/canopStatic analysis CLI that scans AI-generated code for vulnerabilities like SQL injection, unsafe reflection, and hardcoded secrets, with SARIF export…
nccgroup/matt.netMatt.Net is a simple GUI wrapper around Microsoft's CAT.NET Code Auditing Tool
xiaoqimikko/jackson-checkjackson-databind + jackson-core 26 条安全公告自查:按坐标逐条求交集给出真正到位的版本(2.18.11/2.21.7/2.22.3/3.1.7/3.2.3,2.21.6 已不够);扫源码降噪告诉你真中几条;含 1 条 GitHub…
xs2024770/cve-2024-57521-ruoyi-sqliStatic code audit of CVE-2024-57521, an authenticated SQL injection in RuoYi-Vue's generator module, with source-to-sink analysis and a %0b filter…
auditinfra-io/o1js-scanDependency-free static analyzer for zk circuit soundness bugs in o1js/Mina zkApps and Noir circuits
shentao83/news-8.6.0-cve-2026-8726-backportMinimal security backport for CVE-2026-8726 in georgringer/news 8.6.0
abraxas/drupal-move-block-markupDrupal 11.4.8 - High - Remote - XSS - Move Block sibling labels skip @label escaping
rakib-nyc/nulloriginResearch-only AI watermark robustness toolkit: local reverse proxy strips C2PA/EXIF/XMP, Unicode, image/audio stego, OOXML/PDF metadata, and scans…
carlosalbertotuma/advisoryPublic security advisories and PoCs for vulnerabilities discovered in open-source web software, with root-cause analysis, CVE references,…
squid-protocol1/gitgalaxyAST-free heuristic knowledge graph engine for deep repository intelligence and zero-trust security scanning. Integrates as a GitLab CI/CD component,…
joshuaprovoste/deserializerAST-based Static Code Analyzer with Agentic LLM-Powered Relationship Mapping to discover Python RCE paths and deep deserialization chains on AI, LLM,…
vulnz/sastFree offline SAST engine for CI/CD: AST and cross-file taint analysis, secret detection with live validation, SCA/CVE, IaC misconfiguration, and…
