Tools

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

usestrix/strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

gaasedelen/lighthouse

A Coverage Explorer for Reverse Engineers

keygraphhq/shannon

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…

dmdhrumilmistry/security-harness

Multi-agent static application-security review harness for AI coding agents: maps codebases, hunts vulnerability classes, chains and verifies…

nvidia/skillspector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…

m14r41/scan4secrets

Find credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF,…

trufflesecurity/trufflehog

Find, verify, and analyze leaked credentials

projectdiscovery/nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

icsharpcode/ilspy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

nealbridges/vulnhunter

Agentic AI security scanner that reasons like an attacker over source code, confirms exploitable flaws with executable PoCs, and drives test-first…

pycqa/bandit

Bandit is a tool designed to find common security issues in Python code.

huhusmang/awesome-llms-for-vulnerability-detection

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers…

atomdrift-project/scan

0-day malware detection for binaries, source & scripts (that doesn't suck)

snyk/cli

Snyk CLI scans and monitors your projects for security vulnerabilities.

danoszz/penthera

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

symgraph/idassist

AI-Powered Reverse Engineering Plugin for IDA Pro