#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
node9-ai/node9-proxyIAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and…
trailofbits/skillsTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
praetorian-inc/titusHigh-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.
rderaison/bromureProper sandboxing for agentic coding and web browsing
firelock-ai/kinSemantic graph-based version control for AI-written code. Tracks entities and relations instead of file diffs, enabling blast radius analysis, shadow…
davidholiday/cve-2007-4559Educational demonstration of CVE-2007-4559 Python tarfile symlink attack with a script showing why os.path.realpath() fails to prevent extraction…
qubesos/qubes-secpackCurated repository of Qubes OS security bulletins, canaries, PGP keys, and ISO digests, with authenticated verification via git tags and detached…
jedisct1/minisignA dead simple tool to sign files and verify digital signatures.
theupdateframework/python-tufPython reference implementation of The Update Framework (TUF)
scopeblind/scopeblind-gatewayEd25519 signed receipts + Cedar policies for AI agents. Finance mandate gate (Legate), proof packs, 3 IETF Internet-Drafts. npx protect-mcp
mebibite/log4jhoundCreated after the disclosure of CVE-2021-44228. Bash script that detects Log4j occurrences in your projects and systems, allowing you to get insight…
ossf/scorecardOpenSSF Scorecard - Security health metrics for Open Source
wolfssl/wolfsslThe wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3 and DTLS…
agentguard-ai/tealtigerPowerful protection for AI agents - Open-source security and cost tracking for AI applications
boxed-dev/vibe-coding-securityPre-launch security checklist for AI-generated apps (Lovable, v0, Bolt, Cursor). 69 checks covering Supabase RLS, exposed keys, and prompt injection.…
devang-solanki/cve-2018-6574Exploit for remote command execution in Golang go get command.
aetherai3/aether-protocol-pWorking implementation: cryptographically verified short-lived identities for AI decision authentication — CVE-2025-59536 (Patent Pending US…
jitpass/jitFind the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and…
