#1Tools for examining source code without execution to find security flaws.
Kitploit recommended
owasp/trisuella-aidlca-frameworkPolicy-governed LLMSecOps framework providing AST-based SAST, secret scanning, supply-chain and multi-cloud CSPM checks, AI-BoM generation, and CI/CD…
mbennett-labs/crypto-scannerCLI tool to scan codebases for quantum-vulnerable cryptography
nccgroup/secretscrubProcesses SARIF output from static analysis tools to detect and redact hard-coded secrets in source code, creating a clean copy without the original…
thrilokh-q123/cve-2025-23134_fixes_codeThe ASN1_STRING_set() function takes an `int` length, make sure the argument is not inadvertently truncated when it is called from asn1_ex_c2i().
sassoftware/shiroCVE-2026-49268 — Analysis and Remediation of an LDAP Injection Authentication Bypass Vulnerability
minhhk68/cve-2026-13158Proof-of-concept exploit and technical advisory for an Admin+ arbitrary file upload to remote code execution vulnerability in Everest Toolkit…
ockeghem/cve-2015-6835-checkerPHP script to detect CVE-2015-6835 (session deserialization vulnerability) by analyzing source code for unsafe unserialize() calls in session…
niffyhunt/codeguard-copilotAI-powered security co-pilot that catches vulnerabilities as you code. Real-time security scanning, educational explanations, and auto fixes for…
rh-rahulshetty/log4shell-cve-2021-44228Deliberately vulnerable Java/Maven fixture for testing Log4Shell (CVE-2021-44228) detection, code-impact classification, and remediation guidance in…
luiscastellanos-dev/cobol-shieldSecurity hardening toolkit for COBOL legacy systems — invisible Unicode detection, format boundary analysis, source transformation integrity
anna-kravets/codeql-buffer-overflow-variantSynthetic CWE-120 stack buffer overflow variant of CVE-2020-8597 (pppd EAP) as a CodeQL static-analysis target
offensive360/sast-scan-actionGitHub Action for Offensive360 SAST scans and SARIF results. See the open-source program for eligibility and setup.
jaydendancer12/ai-code-reviewAI-powered CLI tool that reviews code for security vulnerabilities, bugs, and anti-patterns using LLMs. Supports local and cloud providers, git…
offensive360/mcp-serverMCP server that runs SAST scans on local codebases and returns findings with severity and fixes, enabling AI assistants to perform security analysis…
sam00/cve-2026-56158-.net-framework-rce-poc-exploitGenerates five .NET deserialization payload formats for CVE-2026-56158, delivers them over HTTP/SOAP/JSON endpoints, includes mock server, scanner,…
yousif-iq/cve-2026-39259CVE-2026-39259
merbinr/cve-2023-31606Documentation of CVE-2023-31606: a ReDoS vulnerability in Redcloth gem's sanitize_html function, with root cause analysis, CVSS 7.5 scoring, and…
arian-gogani/enforcement-coverageFinds API routes carrying weaker authorization than their siblings. Recovered CVE-2026-45316 from source. Includes the negative results.
