Tools

owasp/owasp-ctf-in-a-box

Self-hosted OWASP CTF kit: one box, one free GitHub org, no cloud dependencies

owasp/devsecopsguideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

owasp/threat-dragon

An open source threat modeling tool from OWASP

owasp/docksec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

owasp/kubelight

OWASP Kubernetes security and compliance tool [WIP]

microsoft/agent-governance-toolkit

Policy enforcement, zero-trust identity, execution sandboxing, and audit logging for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10 with…

owasp/wrongsecrets

Vulnerable app with examples showing how to not use secrets

owasp/securecodingdojo

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

owasp/glue

Application Security Automation

securityrat/securityrat

OWASP SecurityRAT (version 1.x) - Tool for handling security requirements in development

owasp/openshield

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix them with…

coreruleset/ftw

YAML-driven framework for testing Web Application Firewall (WAF) rules using OWASP Core Rule Set baselines. Automates regression detection and…

owasp/agent-security-regression-harness

Executable security regression testing for agentic applications and MCP-integrated systems.

owasp/cumulus

Cumulus. Threat modeling the Clouds.

owasp/appsec-agent

A TypeScript package that provides AI-powered agents for Application Security (AppSec) tasks, built on top of the frontier models.

defectdojo/django-defectdojo

Open-Source Unified Vulnerability Management, DevSecOps & ASPM

dependencytrack/dependency-track

Intelligent Component Analysis platform that leverages SBOMs to identify and reduce software supply chain risk through continuous vulnerability…

flipkart-incubator/astra

Automated Security Testing For REST API's