#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
google/osv-scannerVulnerability scanner written in Go which uses the data provided by https://osv.dev
kyverno/kyvernoEnforce security and compliance on Kubernetes clusters via admission controls, resource mutation, background scans, and container image signature…
anchore/grypeA vulnerability scanner for container images and filesystems
snyk/cliSnyk CLI scans and monitors your projects for security vulnerabilities.
mmiszczyk/cve-2021-33879GameLoop update MITM
hoppr/hoppr-copAggregates vulnerability data from multiple databases into CycloneDX SBOMs, generating deduplicated VEX, HTML, and GitLab-compatible reports for…
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
nvidia/skillspectorSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…
robert-auger/safer-dependenciesAutomated dependency security layer for AI coding assistants that audits packages for CVEs, typosquats, abandonment, version-age issues, and hash…
adibirzu/openclaw-security-monitorProactive security monitoring for OpenClaw deployments. Detects ClawHavoc, AMOS stealer, CVE-2026-25253, memory poisoning, and supply chain attacks.
sheeki03/tirithTerminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and…
projectdiscovery/depxMalicious package & supply-chain intelligence
dependencytrack/dependency-trackIntelligent Component Analysis platform that leverages SBOMs to identify and reduce software supply chain risk through continuous vulnerability…
hotcakex/harden-windows-securityHarden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
vinnimarcon/log4j-updaterLog4J Updater Bash Script to automate the framework update process on numerous machines and prevent the CVE-2021-44228
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
