#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
ossf/criticality_scoreComputes a criticality score for open source projects from repository, contributor, and dependency metrics to prioritize security improvements.
jedisct1/minisignA dead simple tool to sign files and verify digital signatures.
spdx/tools-pythonA Python library to parse, validate and create SPDX documents.
in-toto/in-totoProtects software supply chain integrity by verifying each step is performed by authorized functionaries, using signed layout and link metadata.
anchore/syftCLI tool and library for generating a Software Bill of Materials from container images and filesystems
kyverno/kyvernoEnforce security and compliance on Kubernetes clusters via admission controls, resource mutation, background scans, and container image signature…
dependency-check/dependencycheckOWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
secure-systems-lab/securesystemslibCryptographic and general-purpose routines for Secure Systems Lab projects at NYU
cyclonedx/cyclonedx-cliCLI for generating, analyzing, merging, diffing, validating, signing, and converting CycloneDX SBOMs across JSON, XML, Protobuf, CSV, and SPDX…
sigstore/fulcioCertificate authority issuing short-lived code-signing certificates tied to OpenID Connect identities, enabling verifiable software supply chain…
promptfoo/modelauditSecurity scanner for AI/ML model files. Detects malicious code, backdoors, and vulnerabilities before deployment
chainguard-dev/melangeCompiles source code into auditable, signed APK packages using declarative pipelines for Wolfi/Alpine, with multi-architecture QEMU emulation and…
appsec-forge/appsec-forgeStructured security knowledge base with production-inspired cases: vulnerability analysis, exploit explanation, remediation, and DevSecOps for…
aaravmaloo/reveraThe credit score for npm packages. Analyze package reputation, maintenance, security, publisher trust, and ecosystem health before you install any…
ransomleak/training-application-securityInteractive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and…
gitlab-security-oss/cis/gitlabcisAudits GitLab projects against the CIS GitLab Benchmark via read-only API checks, generating JSON reports on compliance and hardening recommendations.
wattocyber/masqLive recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.
