Tools

kata-containers/kata-containers

Secure OCI container runtime that runs workloads inside lightweight VMs, providing strong isolation across Kubernetes, containerd, and CRI-O with…

getanteon/anteon

eBPF-powered Kubernetes monitoring and performance testing platform that automatically generates service maps, tracks real-time metrics, and runs…

salesforce/cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

sighupio/permission-manager

Permission Manager is a project that brings sanity to Kubernetes RBAC and Users management, Web UI FTW

zeus-labs/zeuscloud

Open-source cloud security platform that discovers attack paths, identifies misconfigurations, visualizes IAM access, and provides step-by-step…

kubesphere/kubeeye

Cloud-native Kubernetes cluster inspection tool that detects application misconfigurations, unhealthy components, and node problems using custom OPA,…

eilonh/s3crets_scanner

Automated scanner that hunts for secrets (API keys, credentials) accidentally uploaded to public S3 buckets, using truffleHog3 for detection and…

batfish/pybatfish

Python client for Batfish, a network configuration analysis tool that validates security, reliability, and compliance by modeling network behavior…

summitroute/aws_exposable_resources

Curated catalog of AWS resource types that can be publicly exposed, with CLI commands for creating and auditing public access configurations across…

redhuntlabs/bucketloot

BucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom…

cred-club/dial

Event-driven AWS security misconfiguration detection framework that monitors multiple accounts in real-time, triggering alerts via Lambda for IAM,…

lightspin-tech/red-shadow

Scans AWS IAM configurations for shadow admins by detecting misconfigured deny policies that fail to restrict user actions on groups, enabling…

xlab-si/iac-scan-runner

Service that scans your Infrastructure as Code for common vulnerabilities

mitiga/log4shell-cloud-scanner

we are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in…

george0papasotiriou/cve-2026-9999-serverless-event-injection-to-code-overwrite

Proof-of-concept exploit for CVE-2026-9999, demonstrating path traversal in serverless object storage events that overwrites function source code to…

roxanne_ardary/aurea

Aurea is an open-source, AI-powered platform that secures infrastructure-as-code (IaC) across Terraform, Kubernetes, Docker, and Ansible. It…

h4wkst3r/dop2mop

OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure, collecting CI/CD pipeline, service principal, and ML…

alvin-alvo/safenet-soho-security-framework

A lightweight, policy-driven framework that brings Zero-Trust micro-segmentation to SOHO networks using WireGuard.