#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
sigstore/fulcioCertificate authority issuing short-lived code-signing certificates tied to OpenID Connect identities, enabling verifiable software supply chain…
lirantal/npqsafely install npm packages by auditing them pre-install stage
owasp/aisvsThe AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to…
owasp/aptsOWASP Autonomous Penetration Testing Standard
al0ne/linuxcheckLinux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查
murphysecurity/murphysecAn open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。
pypa/advisory-databaseCommunity-owned database of security advisories for Python packages on PyPI, providing structured vulnerability data in OSV format for integration…
google/capslockCLI tool for analyzing Go package capabilities by tracing transitive calls to privileged standard library operations, enabling supply chain risk…
owasp/cve-lite-cliFast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix,…
luckypipewrench/pipelockOpen-source AI agent firewall that scans HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, emitting verifiable…
asamassekou10/ship-safeThe independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic…
chainguard-dev/melangeCompiles source code into auditable, signed APK packages using declarative pipelines for Wolfi/Alpine, with multi-architecture QEMU emulation and…
trailofbits/ficklingA Python pickling decompiler and static analyzer
lunasec-io/lunasecLunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and…
amalmurali47/git_rceExploit PoC for CVE-2024-32002
praetorian-inc/titusHigh-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.
mindersec/minderSoftware Supply Chain Security Platform
qubesos/qubes-secpackCurated repository of Qubes OS security bulletins, canaries, PGP keys, and ISO digests, with authenticated verification via git tags and detached…
