Tools

owasp/wrongsecrets

Vulnerable app with examples showing how to not use secrets

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

itinerisltd/trellis-cve-2018-6389

Mitigate CVE-2018-6389 WordPress load-scripts / load-styles attacks

alexandreroman/cve-2021-44228-workaround-buildpack

Buildpack providing a workaround for CVE-2021-44228 (Log4j RCE exploit)

gitlab-da/tutorials/security-and-governance/custom-scanner-integration/fern-pattern-scanner

Scans selected files for patterns stated in rules. This is used in order to find secrets you may have accidentally written to a file. This scanner is…

seal-sec-demo-2/javascript-example

Seal Security example — vulnerable npm app (EJS CVE-2022-29078) remediated to sealed versions; GitHub Actions + Jenkins integration

seal-sec-demo-2/java-example

Seal Security example — vulnerable Maven app (SnakeYAML CVE-2022-1471) remediated to sealed versions; GitHub Actions + Jenkins integration

seal-sec-demo-2/python-example

Seal Security example — vulnerable pip app (PyYAML CVE-2020-14343) remediated to sealed versions; GitHub Actions + Jenkins integration

chainguard-dev/text4shell-policy

ClusterImagePolicy demo for cve-2022-42889 text4shell

ansvar-systems/eu_compliance_mcp

EU focused compliance MCP server

owasp/devsecopsguideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

agent-field/sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.