Supply Chain Security

cr0hn/dockerscan

The Most Comprehensive Docker Security Scanner

guacsec/guac

Aggregates software supply chain security metadata (SBOMs, attestations, vulnerabilities) into a queryable graph database for audit, policy, and risk…

owasp/devsecopsguideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

aikidosec/safe-chain

Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.

ossf/allstar

GitHub App to set and enforce security policies

sigstore/rekor

Software Supply Chain Transparency Log

getprobo/probo

Open source solutions for SOC2, GDPR, and ISO27001

pypa/pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

ossf/criticality_score

Computes a criticality score for open source projects from repository, contributor, and dependency metrics to prioritize security improvements.

owasp-dep-scan/dep-scan

Next-generation dependency vulnerability scanner with reachability analysis, SBOM generation, license audit, and container image scanning for CI/CD…

aquasecurity/trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

knostic/openant

OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws…

in-toto/in-toto

Protects software supply chain integrity by verifying each step is performed by authorized functionaries, using signed layout and link metadata.

datadog/guarddog

🐍 🔍 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

rhboot/shim

UEFI shim loader

safedep/vet

Protect against malicious open source packages 🤖