#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
harekrishnarai/xz-utils-vuln-checkerChecker for CVE-2024-3094 where malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of…
bkhablenko/cve-2017-8046Demonstrates exploitation of CVE-2017-8046 in a Spring Boot application, including a SpEL injection payload and dependency-check verification for…
gadievron/raptorAutonomous security research framework integrating static analysis, binary analysis, fuzzing, LLM-powered vulnerability validation, exploit…
in-toto/in-totoProtects software supply chain integrity by verifying each step is performed by authorized functionaries, using signed layout and link metadata.
vercel-labs/deepsecAgent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…
asamassekou10/ship-safeThe independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic…
cyclonedx/cyclonedx-cliCLI for generating, analyzing, merging, diffing, validating, signing, and converting CycloneDX SBOMs across JSON, XML, Protobuf, CSV, and SPDX…
dependency-check/dependencycheckOWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
sigstore/fulcioCertificate authority issuing short-lived code-signing certificates tied to OpenID Connect identities, enabling verifiable software supply chain…
owasp/cve-lite-cliFast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix,…
0sec-labs/foxguardA fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits,…
koadt/oss-oopssec-storeSecurity training for the apps you actually ship. Open your browser and start hacking.
sigstore/cosignCode signing and transparency for containers and binaries
ottosulin/awesome-ai-securityA collection of awesome resources related AI security
trailofbits/skillsTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
rderaison/bromureProper sandboxing for agentic coding and web browsing
davidholiday/cve-2007-4559Educational demonstration of CVE-2007-4559 Python tarfile symlink attack with a script showing why os.path.realpath() fails to prevent extraction…
