
cloudfox
Automating situational awareness for cloud penetration tests.

Automating situational awareness for cloud penetration tests.

Snyk CLI scans and monitors your projects for security vulnerabilities.

Secure and fast microVMs for serverless computing.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Static analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Secure runtime to sandbox AI agent tasks. Run untrusted code in isolated WebAssembly environments.

Serverless task distribution framework that parallelizes CLI tools across thousands of cloud functions for rapid reconnaissance and data processing.

OpenMAIC 1.0.0: Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass

PoC for CVE-2026-22015: malicious event injects environment variables into serverless functions, overwriting secrets and enabling privilege…

Cursor plugin for Hono v4 (TypeScript edge web framework). 59 LLM regressions with BAD/CORRECT pairs. Pinned to hono ^4.12.19 (>= 4.9.7 for…

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.