
Serverless-Goat
OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

OWASP Serverless Top 10

Simulates CVE-2026-23007 serverless cold-start memory remanence; demonstrates how persistent global state across Lambda invocations can leak secrets…

Snyk CLI scans and monitors your projects for security vulnerabilities.

SAST CLI for scanning Java, JavaScript, and .NET applications plus AWS Lambda functions, detecting code vulnerabilities and over-permissive IAM…

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…

Transforms SAM templates into CloudFormation resources, generating Lambda functions, IAM roles, and policies with built-in serverless best practices.

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

Static analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Proof-of-concept exploit for CVE-2026-9999, demonstrating path traversal in serverless object storage events that overwrites function source code to…

PoC exploit for CVE-2026-21002 serverless cold-start credential leakage, demonstrating how reused Lambda /tmp directories expose AWS secrets to other…

AWS Serverless Security

a Damn Vulnerable Serverless Application

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Docker lab reproducing the FOSSBilling pre-auth RCE chain (CVE-2026-27604 auth bypass + CVE-2026-28496 Twig SSTI) with a Python PoC and patched…