Tools

owasp/java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

owasp/docksec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

nuguardai/nuguard

opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis

owasp/cve-lite-cli

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix,…

owasp/ocsd

OWASP Certified Secure-Software Developer

keygraphhq/shannon

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…

owasp/railsgoat

A vulnerable version of Rails that follows the OWASP Top 10

owasp/aisvs

The AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to…

owasp/cheatsheetseries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

geeksikhsecurity/ai-tool-poisoning-guard

Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03,…

owasp/wrongsecrets-binaries

Source code for the Binaries of OWASP WrongSecrets

owasp/asvs

Application Security Verification Standard

owasp/devguide

The OWASP Developer Guide

bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

owasp/appsec-agent

A TypeScript package that provides AI-powered agents for Application Security (AppSec) tasks, built on top of the frontier models.

owasp/vulnreach

Runtime-aware SCA — proves which CVEs are actually reachable, not just installed.

owasp/pytm

A Pythonic framework for threat modeling

owasp/owasp-scs

OWASP Smart Contract Security (SCS) Project