Supply Chain Security

gitleaks/gitleaks

Fast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

nvidia/skillspector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…

trailofbits/skills

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

anchore/grype

A vulnerability scanner for container images and filesystems

vercel-labs/deepsec

Agent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…

kyverno/kyverno

Enforce security and compliance on Kubernetes clusters via admission controls, resource mutation, background scans, and container image signature…

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

anchore/syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

dependency-check/dependencycheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

bridgecrewio/checkov

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

snyk/cli

Snyk CLI scans and monitors your projects for security vulnerabilities.

sigstore/cosign

Code signing and transparency for containers and binaries

ossf/scorecard

OpenSSF Scorecard - Security health metrics for Open Source

microsoft/azurelinux

Hardened, Azure-optimized Linux distribution built from Fedora sources with RPM packaging, supply chain security, and declarative configuration for…

dependencytrack/dependency-track

Intelligent Component Analysis platform that leverages SBOMs to identify and reduce software supply chain risk through continuous vulnerability…