#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
bkuan001/halo-recordTamper-evident audit trails for AI agents: hash-chained Runtime Records, dependency-free, verifiable by anyone.
namegabevictoire01-sys/cs50-cybersecurity-final-projectCS50 Cybersecurity Final Project - Analysis of CVE-2024-3094
michel-dv/xz-utils-backdoor-case-studyTechnical case study of the XZ Utils backdoor (CVE-2024-3094), covering supply-chain trust abuse, malicious release artifacts, build-stage injection,…
microsoft/applicationinspectorA source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…
owasp/trisuella-aidlca-frameworkPolicy-governed LLMSecOps framework providing AST-based SAST, secret scanning, supply-chain and multi-cloud CSPM checks, AI-BoM generation, and CI/CD…
soemoescode/guardskillRead-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP…
rh-rahulshetty/log4shell-cve-2021-44228Deliberately vulnerable Java/Maven fixture for testing Log4Shell (CVE-2021-44228) detection, code-impact classification, and remediation guidance in…
xiaoqimikko/spring-cvss-checkScans Java artifacts and source for Spring/Tomcat CVEs, compares vendor vs NVD CVSS scores, verifies exploitability conditions, and checks if fix…
8b-is/smart-treeSmart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search,…
owasp/owasp-aibomOWASP project defining an AI Bill of Materials (AIBOM) standard to document AI/ML components, dependencies, and supply chain risks for AI security…
xiaoqimikko/netty-resolver-dns-checkOffline static checker that inspects packaged Java jars for vulnerable netty-resolver-dns versions and detects whether Spring WebClient actually uses…
eskatos/creadur-rat-gradleApache RAT (Release Audit Tool) Gradle Plugin
joshuaasmith/reproducer-okio-cve-2023-3635Reproducer for CVE-2023-3635 in Okio 2.9.0, demonstrating how React Native's version catalog pins a vulnerable dependency, affecting Android apps.
yonliud/cve-2026-0303Checkov PoC: arbitrary code execution through auto-loaded configuration and unsigned external Python checks.
ransomleak/training-application-securityInteractive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and…
pypa/pip-auditAudits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
xiaoqimikko/tomcat-line-checkCVE-2026-24880: does Apache's upgrade advice actually apply to your Tomcat? Detects the fix by class presence, not version comparison. Covers…
xiaoqimikko/thymeleaf-checkOffline checker for Thymeleaf CVE-2026-40477 / CVE-2026-41901 — tells you which of the two CVSS 9.0 SSTI flaws you are exposed to, and whether your…
