Tools

anchore/grype

A vulnerability scanner for container images and filesystems

safedep/vet

Protect against malicious open source packages 🤖

osmankandemir/docf-sec-check

Static analysis tool that scans Dockerfiles for insecure commands and configuration issues, providing actionable security notifications to harden…

quay/clair

Vulnerability Static Analysis for Containers

bridgecrewio/checkov

Static analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…

anchore/anchore-engine

A service that analyzes docker images and scans for vulnerabilities

zupit/horusec

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

praetorian-inc/titus

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

owasp/docksec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

hawkeyesec/scanner-cli

A project security/vulnerability/risk scanning tool

darkarnium/log4j-cve-detect

Detections for CVE-2021-44228 inside of nested binaries

otsmane-ahmed/ci-supplychain-guard

Static analysis tool that detects malicious dependencies in CI/CD pipelines using pattern matching and AST analysis, with a traffic-light risk…

mhaggis/package-inferno

A Public Package Scanner for The Community

maweil/bidi_char_detector

Checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks. See CVE-2021-42574

aquasecurity/trivy-module-wordpress

Trivy example module for WordPress

qianlijaingshan/fastgpt-sandbox-audit

FastGPT Python sandbox escape chain audit tool (CVE-2026-32128 related, v4.14.8 inspect chain)